xfsdump: prevent segfault in cb_add_inogrp

The call to memset will segfault because the offset for the first
parameter is done twice. We are using pointer math to do the
calculation.

The first time is when calculating oldsize, the size of i2gseg_t
is accounted for.
	oldsize = (numsegs - SEGPERHNK) * sizeof(i2gseg_t);
Then in the call to memset, oldsize is again multiplied by the size
of i2gmap_t.
	memset(inomap.i2gmap + oldsize, ...)

i2gmap holds the used inodes in each chunk. When there are 2^31 chunk
entries, it could describe 2^31 (1 inode/chunk)- 2^40 (64 inodes/chunk).

With 100s of millions of inodes there are enough entries to wrap the
32 bit variable oldsize.

Adding a bounds check (numsegs < 0) and switching to use array
index notation instead of calculating the pointer address twice
would resolve this issue. The unneeded local variable oldsize
can be removed as well.

Signed-off-by: Rich Johnston <rjohnston@sgi.com>
Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Dave Chinner <david@fromorbit.com>

1 files changed, 3 insertions, 5 deletions

diff --git a/dump/inomap.c b/dump/inomap.c
index 9b385ec0..a35059aa 100644
--- a/dump/inomap.c
+++ b/dump/inomap.c
@@ -1126,13 +1126,14 @@ cb_add_inogrp( void *arg1, intgen_t fsfd, xfs_inogrp_t *inogrp )
 
 		if (lastsegp->hnkoff == inomap.hnkmaplen) {
 			intgen_t numsegs;
-			intgen_t oldsize;
 
 			inomap.hnkmaplen++;
 			inomap.hnkmap = (hnk_t *)
 				realloc(inomap.hnkmap, inomap.hnkmaplen * HNKSZ);
 
 			numsegs = inomap.hnkmaplen * SEGPERHNK;
+			if (numsegs < 0)
+				return -1;
 			inomap.i2gmap = (i2gseg_t *)
 				realloc(inomap.i2gmap, numsegs * sizeof(i2gseg_t));
 
@@ -1140,10 +1141,7 @@ cb_add_inogrp( void *arg1, intgen_t fsfd, xfs_inogrp_t *inogrp )
 				return -1;
 
 			/* zero the new portion of the i2gmap */
-			oldsize = (numsegs - SEGPERHNK) * sizeof(i2gseg_t);
-
-			memset(inomap.i2gmap + oldsize,
-			       0,
+			memset(&inomap.i2gmap[numsegs - SEGPERHNK], 0,
 			       SEGPERHNK * sizeof(i2gseg_t));
 		}