diff options
Diffstat (limited to 'fs')
| -rw-r--r-- | fs/squashfs/sqfs.c | 15 |
1 files changed, 13 insertions, 2 deletions
diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c index cd88923521e..e2741380f93 100644 --- a/fs/squashfs/sqfs.c +++ b/fs/squashfs/sqfs.c @@ -910,13 +910,24 @@ static int sqfs_read_directory_table(unsigned char **dir_table, u32 **pos_list) if (metablks_count < 1) goto out; - *dir_table = malloc(metablks_count * SQFS_METADATA_BLOCK_SIZE); + if (__builtin_mul_overflow(metablks_count, SQFS_METADATA_BLOCK_SIZE, + &buf_size)) { + metablks_count = -1; + goto out; + } + + *dir_table = malloc(buf_size); if (!*dir_table) { metablks_count = -1; goto out; } - *pos_list = malloc(metablks_count * sizeof(u32)); + if (__builtin_mul_overflow(metablks_count, sizeof(u32), &buf_size)) { + metablks_count = -1; + goto out; + } + + *pos_list = malloc(buf_size); if (!*pos_list) { metablks_count = -1; goto out; |