[PATCH 2/8] erofs-utils: mkfs: fix incremental superblock stack overread

[Yifan Zhao <stopire@gmail.com>]

Running mkfs.erofs --incremental on a base image with sb_extslots > 1
retains a superblock size larger than the 144-byte stack object in
erofs_writesb(). The final memcpy() reads past that object and writes
adjacent stack contents into the image.

Trigger path:
  main()
    erofs_mkfs_load_fs()
      erofs_read_superblock()  /* sb_size = 128 + sb_extslots * 16 */
    erofs_writesb()
      memcpy(..., &sb, sbi->sb_size)

Let's limit the source image sb size in incremental builds.

Fixes: c6903c7e32a1 ("erofs-utils: dump,fsck,fuse: support metadata compression")
Assisted-by: Codex:gpt-6-astra
Assisted-by: Claude Code:deepseek-v4.1-flash-1017
Signed-off-by: Yifan Zhao <stopire@gmail.com>
---
 lib/super.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/lib/super.c b/lib/super.c
index 5cb9016..694a3e9 100644
--- a/lib/super.c
+++ b/lib/super.c
@@ -515,6 +515,12 @@ int erofs_mkfs_load_fs(struct erofs_sb_info *sbi, unsigned int dsunit)
 		return err;
 	}
 
+	if (sbi->sb_size > sizeof(struct erofs_super_block)) {
+		erofs_err("unsupported superblock size %u for incremental builds",
+			  sbi->sb_size);
+		return -EOPNOTSUPP;
+	}
+
 	err = erofs_io_fstat(&sbi->bdev, &u.st);
 	if (!err && S_ISREG(u.st.st_mode))
 		u.startblk = DIV_ROUND_UP(u.st.st_size, erofs_blksiz(sbi));
-- 
2.56.0