[PATCH 2/4] fs: zfs: prevent integer overflow in zfs_nvlist_lookup_nvlist()

[Timo tp Preißl]

Signed-off-by: Timo tp Preißl <t.preissl at proton.me>
---
 fs/zfs/zfs.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/fs/zfs/zfs.c b/fs/zfs/zfs.c
index 410a61aa611..aa6673ea75e 100644
--- a/fs/zfs/zfs.c
+++ b/fs/zfs/zfs.c
@@ -1627,9 +1627,12 @@ zfs_nvlist_lookup_nvlist(char *nvlist, char *name)
 	 * nvlist to hold the encoding method, and two zero uint32's after the
 	 * nvlist as the NULL terminator.
 	 */
-	ret = calloc(1, size + 3 * sizeof(uint32_t));
-	if (!ret)
-		return 0;
+	if (__builtin_add_overflow(size, 3 * sizeof(uint32_t), &alloc))
+        return 0;
+
+    ret = calloc(1, alloc);
+    if (!ret)
+        return 0;
 	memcpy(ret, nvlist, sizeof(uint32_t));
 
 	memcpy(ret + sizeof(uint32_t), nvpair, size);
-- 
2.43.0