| commit | 73d95e7b04162376761b6c942d74cd18b1556dce | |
| author | Richard Weinberger <richard@nod.at> | |
| Tue, 22 Sep 2015 21:58:07 +0000 (22 23:58 +0200) | ||
| committer | Ben Hutchings <ben@decadent.org.uk> | |
| Tue, 17 Nov 2015 15:54:41 +0000 (17 15:54 +0000) | ||
| tree | 4a8b01c2a126755281c189291a41ef346c6a47cd | treesnapshot (tar.gz zip) |
| parent | a92a5446e2482938e1bce89789235cf814cd85d1 | commitdiff |
UBI: Validate data_size
commit 281fda27673f833a01d516658a64d22a32c8e072 upstream.
Make sure that data_size is less than LEB size.
Otherwise a handcrafted UBI image is able to trigger
an out of bounds memory access in ubi_compare_lebs().
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: David Gstir <david@sigma-star.at>
[bwh: Backported to 3.2: drop first argument to ubi_err()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
commit 281fda27673f833a01d516658a64d22a32c8e072 upstream.
Make sure that data_size is less than LEB size.
Otherwise a handcrafted UBI image is able to trigger
an out of bounds memory access in ubi_compare_lebs().
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: David Gstir <david@sigma-star.at>
[bwh: Backported to 3.2: drop first argument to ubi_err()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
| drivers/mtd/ubi/io.c | diffblobblamehistory |