7804 fdisk_read_master_part_table() causes 'format' to crash
Reviewed by: Jason King <jason.brian.king@gmail.com>
Reviewed by: Hans Rosenfeld <hans.rosenfeld@nexenta.com>
Reviewed by: Robert Mustacchi <rm@joyent.com>

*** 18,27 ****
--- 18,28 ----
   *
   * CDDL HEADER END
   */
  /*
   * Copyright (c) 2008, 2010, Oracle and/or its affiliates. All rights reserved.
+  * Copyright 2017 The MathWorks, Inc.  All rights reserved.
   */
  
  #include <stdio.h>
  #include <stdlib.h>
  #include <string.h>
*** 766,794 ****
   * MBR is supposed to be of 512 bytes no matter what the device block size is.
   */
  static int
  fdisk_read_master_part_table(ext_part_t *epp)
  {
!         uchar_t buf[512];
!         int sectsize = 512;
          int size = sizeof (struct ipart);
          int cpcnt = FD_NUMPART * size;
  
          if (lseek(epp->dev_fd, 0, SEEK_SET) < 0) {
                  return (EIO);
          }
          if (read(epp->dev_fd, buf, sectsize) < sectsize) {
                  return (EIO);
          }
  
          /*LINTED*/
          if (LE_16((*(uint16_t *)&buf[510])) != MBB_MAGIC) {
                  bzero(epp->mtable, cpcnt);
                  return (FDISK_EBADMAGIC);
          }
  
          bcopy(&buf[FDISK_PART_TABLE_START], epp->mtable, cpcnt);
  
          return (FDISK_SUCCESS);
  }
  
  int
--- 767,810 ----
   * MBR is supposed to be of 512 bytes no matter what the device block size is.
   */
  static int
  fdisk_read_master_part_table(ext_part_t *epp)
  {
!         struct dk_minfo_ext dkmp_ext;
!         uchar_t *buf;
!         int sectsize;
          int size = sizeof (struct ipart);
          int cpcnt = FD_NUMPART * size;
  
          if (lseek(epp->dev_fd, 0, SEEK_SET) < 0) {
                  return (EIO);
          }
+         if (ioctl(epp->dev_fd, DKIOCGMEDIAINFOEXT, &dkmp_ext) < 0) {
+                 return (EIO);
+         }
+         if (dkmp_ext.dki_lbsize < 512) {
+                 return (EIO);
+         }
+         sectsize = dkmp_ext.dki_lbsize;
+         buf = calloc(sectsize, sizeof (uchar_t));
+         if (buf == NULL) {
+                 return (ENOMEM);
+         }
          if (read(epp->dev_fd, buf, sectsize) < sectsize) {
+                 free(buf);
                  return (EIO);
          }
  
          /*LINTED*/
          if (LE_16((*(uint16_t *)&buf[510])) != MBB_MAGIC) {
                  bzero(epp->mtable, cpcnt);
+                 free(buf);
                  return (FDISK_EBADMAGIC);
          }
  
          bcopy(&buf[FDISK_PART_TABLE_START], epp->mtable, cpcnt);
+         free(buf);
  
          return (FDISK_SUCCESS);
  }
  
  int