wimlib_join(): Fix buffer overrun when swm part 1 not specified

[wimlib] / src / join.c

diff --git a/src/join.c b/src/join.c
index 1904935311f96efae5f98a6ce85eb1bb034d1b2e..8a0abe5d663e912c0a28d6058c820cd368eebedc 100644 (file)
--- a/src/join.c
+++ b/src/join.c
@@ -38,17 +38,17 @@
  *                  correspond to a spanned set.
  *
  * @wim:
- *     Part 1 of the set.
+ *     Part 1 of the set.
  *
  * @additional_swms:
- *     All parts of the set other than part 1.
+ *     All parts of the set other than part 1.
  *
  * @num_additional_swms:
- *     Number of WIMStructs in @additional_swms.  Or, the total number of parts
- *     in the set minus 1.
+ *     Number of WIMStructs in @additional_swms.  Or, the total number of parts
+ *     in the set minus 1.
  *
  * @return:
- *     0 on success; WIMLIB_ERR_SPLIT_INVALID if the set is not valid.
+ *     0 on success; WIMLIB_ERR_SPLIT_INVALID if the set is not valid.
  */
 static int
 verify_swm_set(WIMStruct *wim, WIMStruct **additional_swms,
@@ -169,7 +169,8 @@ wimlib_join(const tchar * const *swm_names,
                return WIMLIB_ERR_INVALID_PARAM;
        num_additional_swms = num_swms - 1;
 
-       additional_swms = CALLOC(num_additional_swms, sizeof(additional_swms[0]));
+       additional_swms = CALLOC((num_additional_swms + 1),
+                                sizeof(additional_swms[0]));
        if (!additional_swms)
                return WIMLIB_ERR_NOMEM;
 
@@ -188,6 +189,7 @@ wimlib_join(const tchar * const *swm_names,
        }
 
        if (!swm0) {
+               ERROR("Part 1 of the split WIM was not specified!");
                ret = WIMLIB_ERR_SPLIT_INVALID;
                goto out_free_swms;
        }
@@ -201,6 +203,8 @@ wimlib_join(const tchar * const *swm_names,
        if (ret)
                goto out_free_swms;
 
+       swm0->guid_set_explicitly = 1;
+
        /* It is reasonably safe to provide, WIMLIB_WRITE_FLAG_STREAMS_OK, as we
         * have verified that the specified split WIM parts form a spanned set.
         */
@@ -208,7 +212,7 @@ wimlib_join(const tchar * const *swm_names,
                           wim_write_flags | WIMLIB_WRITE_FLAG_STREAMS_OK,
                           1, progress_func);
 out_free_swms:
-       for (i = 0; i < num_additional_swms; i++)
+       for (i = 0; i < num_additional_swms + 1; i++)
                wimlib_free(additional_swms[i]);
        FREE(additional_swms);
        wimlib_free(swm0);