Patchwork mtd: bcm47xxpart: avoid overflowing when registering trx

login
register
mail settings
Submitter Rafał Miłecki
Date Feb. 26, 2014, 1:30 p.m.
Message ID <1393421434-23561-1-git-send-email-zajec5@gmail.com>
Download mbox | patch
Permalink /patch/324422/
State Accepted
Commit 108ebcd81907cd4818feb3bc1eabcc4a5373da32
Headers show

Comments

Rafał Miłecki - Feb. 26, 2014, 1:30 p.m.
Our code parsing "trx" header registers few partitions at once (in one
loop iteration). Add extra check in that place.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
---
 drivers/mtd/bcm47xxpart.c | 5 +++++
 1 file changed, 5 insertions(+)
Brian Norris - March 7, 2014, 7:31 a.m.
On Wed, Feb 26, 2014 at 02:30:34PM +0100, Rafał Miłecki wrote:
> Our code parsing "trx" header registers few partitions at once (in one
> loop iteration). Add extra check in that place.
> 
> Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

Pushed to l2-mtd.git. Thanks!

Brian

Patch

diff --git a/drivers/mtd/bcm47xxpart.c b/drivers/mtd/bcm47xxpart.c
index e388e69..23d7122 100644
--- a/drivers/mtd/bcm47xxpart.c
+++ b/drivers/mtd/bcm47xxpart.c
@@ -147,6 +147,11 @@  static int bcm47xxpart_parse(struct mtd_info *master,
 
 		/* TRX */
 		if (buf[0x000 / 4] == TRX_MAGIC) {
+			if (BCM47XXPART_MAX_PARTS - curr_part < 4) {
+				pr_warn("Not enough partitions left to register trx, scanning stopped!\n");
+				break;
+			}
+
 			trx = (struct trx_header *)buf;
 
 			trx_part = curr_part;