diff options
| -rw-r--r-- | libblkid/src/superblocks/nilfs.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/libblkid/src/superblocks/nilfs.c b/libblkid/src/superblocks/nilfs.c index d12472c7e..cd93d7bc5 100644 --- a/libblkid/src/superblocks/nilfs.c +++ b/libblkid/src/superblocks/nilfs.c @@ -72,6 +72,7 @@ static int nilfs_valid_sb(blkid_probe pr, struct nilfs_super_block *sb, int is_b static unsigned char sum[4]; const int sumoff = offsetof(struct nilfs_super_block, s_sum); size_t bytes; + const size_t crc_start = sumoff + 4; uint32_t crc; if (!sb || le16_to_cpu(sb->s_magic) != NILFS_SB_MAGIC) @@ -82,9 +83,15 @@ static int nilfs_valid_sb(blkid_probe pr, struct nilfs_super_block *sb, int is_b return 0; bytes = le16_to_cpu(sb->s_bytes); + /* ensure that no underrun can happen in the length parameter + * of the crc32 call or more data are processed than read into + * sb */ + if (bytes < crc_start || bytes > sizeof(struct nilfs_super_block)) + return 0; + crc = crc32(le32_to_cpu(sb->s_crc_seed), (unsigned char *)sb, sumoff); crc = crc32(crc, sum, 4); - crc = crc32(crc, (unsigned char *)sb + sumoff + 4, bytes - sumoff - 4); + crc = crc32(crc, (unsigned char *)sb + crc_start, bytes - crc_start); return blkid_probe_verify_csum(pr, crc, le32_to_cpu(sb->s_sum)); } |