[PATCH] erofs-utils: tar: fix overly large size in tar header

[Gao Xiang <hsiangkao@linux.alibaba.com>]

As @oscarjhk reported:

When tar-index mode is used, the inode chunk count will be calculated
as 0 if a crafted GNU base-256 size is UINT64_MAX, which will cause
a heap out-of-bounds write.

Fixes: 95d315fd7958 ("erofs-utils: introduce tarerofs")
Signed-off-by: Gao Xiang <hsiangkao@linux.alibaba.com>
---
 lib/blobchunk.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/lib/blobchunk.c b/lib/blobchunk.c
index 0523873570a2..5e0fb70be687 100644
--- a/lib/blobchunk.c
+++ b/lib/blobchunk.c
@@ -507,7 +507,9 @@ int tarerofs_write_chunkes(struct erofs_inode *inode, erofs_off_t data_offset)
 		datablob_size += round_up(inode->i_size, erofs_blksiz(sbi));
 	}
 	chunksize = 1ULL << chunkbits;
-	count = DIV_ROUND_UP(inode->i_size, chunksize);
+	/* e.g. DIV_ROUND_UP(UINT64_MAX, 1 TiB) can overflow */
+	count = (inode->i_size >> chunkbits) +
+		!!(inode->i_size & (chunksize - 1));
 
 	inode->extent_isize = count * unit;
 	idx = calloc(count, max(sizeof(*idx), sizeof(void *)));
-- 
2.43.5