From 6d5df908a3f77e55232102df497ff6742d0a6719 Mon Sep 17 00:00:00 2001 From: Vitaliy Filippov Date: Fri, 8 Dec 2023 00:01:07 +0300 Subject: [PATCH] Fix possible out of bounds when checking invalid journal entries --- src/blockstore_init.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/src/blockstore_init.cpp b/src/blockstore_init.cpp index 36dbddd1..c958edb3 100644 --- a/src/blockstore_init.cpp +++ b/src/blockstore_init.cpp @@ -732,8 +732,9 @@ int blockstore_init_journal::handle_journal_part(void *buf, uint64_t done_pos, u resume: while (pos < bs->journal.block_size) { - journal_entry *je = (journal_entry*)((uint8_t*)buf + proc_pos - done_pos + pos); - if (je->magic != JOURNAL_MAGIC || je_crc32(je) != je->crc32 || + auto buf_pos = proc_pos - done_pos + pos; + journal_entry *je = (journal_entry*)((uint8_t*)buf + buf_pos); + if (je->magic != JOURNAL_MAGIC || buf_pos+je->size > len || je_crc32(je) != je->crc32 || je->type < JE_MIN || je->type > JE_MAX || started && je->crc32_prev != crc32_last) { if (pos == 0)