From patchwork Thu Jun 4 01:18:25 2009 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Nahor X-Patchwork-Id: 28083 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from bombadil.infradead.org (bombadil.infradead.org [18.85.46.34]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (Client did not present a certificate) by bilbo.ozlabs.org (Postfix) with ESMTPS id 4BBA2B7063 for ; Thu, 4 Jun 2009 11:51:26 +1000 (EST) Received: from localhost ([::1] helo=bombadil.infradead.org) by bombadil.infradead.org with esmtp (Exim 4.69 #1 (Red Hat Linux)) id 1MC21A-0007Gn-9h; Thu, 04 Jun 2009 01:45:20 +0000 Received: from main.gmane.org ([80.91.229.2] helo=ciao.gmane.org) by bombadil.infradead.org with esmtps (Exim 4.69 #1 (Red Hat Linux)) id 1MC20y-0003jh-PC for linux-mtd@lists.infradead.org; Thu, 04 Jun 2009 01:45:17 +0000 Received: from root by ciao.gmane.org with local (Exim 4.43) id 1MC20s-0003uN-P8 for linux-mtd@lists.infradead.org; Thu, 04 Jun 2009 01:45:02 +0000 Received: from adsl-99-185-243-218.dsl.pltn13.sbcglobal.net ([99.185.243.218]) by main.gmane.org with esmtp (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 04 Jun 2009 01:45:02 +0000 Received: from nahor.j+gmane by adsl-99-185-243-218.dsl.pltn13.sbcglobal.net with local (Gmexim 0.1 (Debian)) id 1AlnuQ-0007hv-00 for ; Thu, 04 Jun 2009 01:45:02 +0000 X-Injected-Via-Gmane: http://gmane.org/ To: linux-mtd@lists.infradead.org From: Nahor Subject: [PATCH] [MTD-UTILS] Incorrect loop condition Date: Wed, 03 Jun 2009 18:18:25 -0700 Lines: 37 Message-ID: Mime-Version: 1.0 X-Complaints-To: usenet@ger.gmane.org X-Gmane-NNTP-Posting-Host: adsl-99-185-243-218.dsl.pltn13.sbcglobal.net User-Agent: Thunderbird 2.0.0.21 (Windows/20090302) X-Spam-Score: -1.0 (-) X-Spam-Report: SpamAssassin version 3.2.5 on bombadil.infradead.org summary: Content analysis details: (-1.0 points) pts rule name description ---- ---------------------- -------------------------------------------------- -1.0 RCVD_IN_DNSWL_LOW RBL: Sender listed at http://www.dnswl.org/, low trust [80.91.229.2 listed in list.dnswl.org] X-BeenThere: linux-mtd@lists.infradead.org X-Mailman-Version: 2.1.11 Precedence: list List-Id: Linux MTD discussion mailing list List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-mtd-bounces@lists.infradead.org Errors-To: linux-mtd-bounces+incoming=patchwork.ozlabs.org@lists.infradead.org Hi all, Here is a small patch to fix an obvious typo. If the file contains only a few bytes in the last page and the padding option is selected, the loop may exit early (readlen < meminfo.oobsize). Most of the time it will still work though because the code tries to read the whole OOB in one chunk. On a similar issue, shouldn't the loop reading the input file exit with error if cnt == 0? The loop should alread exit when all the expected data is read. So if cnt == 0, it means that nandwrite didn't get all the data it wanted. The code then goes on as if everything was correctly read so it will write the data from the previous page. This is a security risk (even though the necessary conditions make it nearly impossible in practice). Regards, Nahor break; --- a/nandwrite.c 2009-06-01 18:03:55.000000000 -0700 +++ b/nandwrite.c 2009-06-03 15:29:24.000000000 -0700 @@ -531,7 +531,7 @@ if (writeoob) { int tinycnt = 0; - while(tinycnt < readlen) { + while(tinycnt < meminfo.oobsize) { cnt = read(ifd, oobreadbuf + tinycnt, meminfo.oobsize - tinycnt); if (cnt == 0) { // EOF