btrfs-progs: handle invalid num_stripes in sys_array

We can handle the special case of num_stripes == 0 directly inside
btrfs_read_sys_array. The BUG_ON in btrfs_chunk_item_size is there to
catch other unhandled cases where we fail to validate external data,
like in btrfs-show-super.

Signed-off-by: David Sterba <dsterba@suse.com>

1 files changed, 8 insertions, 0 deletions

diff --git a/volumes.c b/volumes.c
index 32d9a5a6..b4d489a0 100644
--- a/volumes.c
+++ b/volumes.c
@@ -1839,6 +1839,14 @@ int btrfs_read_sys_array(struct btrfs_root *root)
 				goto out_short_read;
 
 			num_stripes = btrfs_chunk_num_stripes(sb, chunk);
+			if (!num_stripes) {
+				printk(
+	    "ERROR: invalid number of stripes %u in sys_array at offset %u\n",
+					num_stripes, cur_offset);
+				ret = -EIO;
+				break;
+			}
+
 			len = btrfs_chunk_item_size(num_stripes);
 			if (cur_offset + len > array_size)
 				goto out_short_read;