git.openpandora.org / pandora-kernel.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: a92a544) | patch
UBI: Validate data_size
authorRichard Weinberger <richard@nod.at>
Tue, 22 Sep 2015 21:58:07 +0000 (23:58 +0200)
committerBen Hutchings <ben@decadent.org.uk>
Tue, 17 Nov 2015 15:54:41 +0000 (15:54 +0000)
commit73d95e7b04162376761b6c942d74cd18b1556dce
tree4a8b01c2a126755281c189291a41ef346c6a47cdtree | snapshot
parenta92a5446e2482938e1bce89789235cf814cd85d1commit | diff
UBI: Validate data_size

commit 281fda27673f833a01d516658a64d22a32c8e072 upstream.

Make sure that data_size is less than LEB size.
Otherwise a handcrafted UBI image is able to trigger
an out of bounds memory access in ubi_compare_lebs().

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: David Gstir <david@sigma-star.at>
[bwh: Backported to 3.2: drop first argument to ubi_err()]
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
drivers/mtd/ubi/io.c diff | blob | history
Pandora Kernel Repository