UBI: Validate data_size

Browse source

[ Upstream commit 281fda2767 ]

Make sure that data_size is less than LEB size.
Otherwise a handcrafted UBI image is able to trigger
an out of bounds memory access in ubi_compare_lebs().

Cc: stable@vger.kernel.org
Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: David Gstir <david@sigma-star.at>
Signed-off-by: Sasha Levin <sasha.levin@oracle.com>

...

This commit is contained in:

Richard Weinberger 2015-09-22 23:58:07 +02:00 • committed by Sasha Levin

parent 5b12405cd0

commit dded44f1af

1 changed files with 5 additions and 0 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download patch file Download diff file Expand all files Collapse all files

5

drivers/mtd/ubi/io.c

View file