5 files changed, 12 insertions, 6 deletions
diff --git a/lib/sqfs/data_reader.c b/lib/sqfs/data_reader.c
index 27a8302..9d24745 100644
--- a/lib/sqfs/data_reader.c
+++ b/lib/sqfs/data_reader.c
@@ -107,7 +107,7 @@ static int precache_fragment_block(data_reader_t *data, size_t idx)
 data_reader_t *data_reader_create(int fd, sqfs_super_t *super,
 				  compressor_t *cmp)
 {
-	data_reader_t *data = calloc(1, sizeof(*data) + 3 * super->block_size);
+	data_reader_t *data = alloc_flex(sizeof(*data), super->block_size, 3);
 	size_t i, size;
 
 	if (data == NULL) {
@@ -136,7 +136,11 @@ data_reader_t *data_reader_create(int fd, sqfs_super_t *super,
 		return NULL;
 	}
 
-	size = sizeof(data->frag[0]) * data->num_fragments;
+	if (SZ_MUL_OV(sizeof(data->frag[0]), data->num_fragments, &size)) {
+		fputs("Too many fragments: overflow\n", stderr);
+		free(data);
+		return NULL;
+	}
 
 	data->frag = sqfs_read_table(fd, cmp, size,
 				     super->fragment_table_start);
diff --git a/lib/sqfs/data_writer.c b/lib/sqfs/data_writer.c
index b52e897..d4b402b 100644
--- a/lib/sqfs/data_writer.c
+++ b/lib/sqfs/data_writer.c
@@ -416,7 +416,7 @@ int write_data_from_fd_condensed(data_writer_t *data, file_info_t *fi,
 			diff = fi->size - offset;
 		}
 
-		blk = calloc(1, sizeof(*blk) + diff);
+		blk = alloc_flex(sizeof(*blk), 1, diff);
 		blk->size = diff;
 		blk->index = i++;
 		blk->user = fi;
diff --git a/lib/sqfs/read_inode.c b/lib/sqfs/read_inode.c
index d13198e..79c5a55 100644
--- a/lib/sqfs/read_inode.c
+++ b/lib/sqfs/read_inode.c
@@ -7,6 +7,7 @@
 #include "config.h"
 
 #include "meta_reader.h"
+#include "util.h"
 
 #include <sys/stat.h>
 #include <stdlib.h>
@@ -89,7 +90,7 @@ static sqfs_inode_generic_t *read_inode_file(meta_reader_t *ir,
 	count = get_block_count(file.file_size, block_size,
 				file.fragment_index, file.fragment_offset);
 
-	out = calloc(1, sizeof(*out) + count * sizeof(uint32_t));
+	out = alloc_flex(sizeof(*out), sizeof(uint32_t), count);
 	if (out == NULL) {
 		perror("reading extended file inode");
 		return NULL;
@@ -132,7 +133,7 @@ static sqfs_inode_generic_t *read_inode_file_ext(meta_reader_t *ir,
 	count = get_block_count(file.file_size, block_size,
 				file.fragment_idx, file.fragment_offset);
 
-	out = calloc(1, sizeof(*out) + count * sizeof(uint32_t));
+	out = alloc_flex(sizeof(*out), sizeof(uint32_t), count);
 	if (out == NULL) {
 		perror("reading extended file inode");
 		return NULL;
diff --git a/lib/sqfs/write_export_table.c b/lib/sqfs/write_export_table.c
index a4ba1b7..f81632a 100644
--- a/lib/sqfs/write_export_table.c
+++ b/lib/sqfs/write_export_table.c
@@ -7,6 +7,7 @@
 #include "config.h"
 
 #include "highlevel.h"
+#include "util.h"
 
 #include <stdlib.h>
 #include <stdio.h>
diff --git a/lib/sqfs/write_xattr.c b/lib/sqfs/write_xattr.c
index 195de0d..7214ea7 100644
--- a/lib/sqfs/write_xattr.c
+++ b/lib/sqfs/write_xattr.c
@@ -152,7 +152,7 @@ static uint64_t *create_ool_locations_table(fstree_t *fs)
 	uint64_t *table;
 	size_t i;
 
-	table = malloc(sizeof(uint64_t) * fs->xattr_values.num_strings);
+	table = alloc_array(sizeof(uint64_t), fs->xattr_values.num_strings);
 
 	if (table == NULL) {
 		perror("allocating Xattr OOL locations table");