* [patch 09/13] mtd/jffs2: fix read buffer overflow
@ 2009-09-18 19:51 akpm
0 siblings, 0 replies; only message in thread
From: akpm @ 2009-09-18 19:51 UTC (permalink / raw)
To: dwmw2; +Cc: roel.kluin, akpm, linux-mtd
From: Roel Kluin <roel.kluin@gmail.com>
Prevent a read from mtd->eraseregions[-1]
Signed-off-by: Roel Kluin <roel.kluin@gmail.com>
Cc: David Woodhouse <dwmw2@infradead.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
---
drivers/mtd/devices/lart.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff -puN drivers/mtd/devices/lart.c~mtd-jffs2-fix-read-buffer-overflow drivers/mtd/devices/lart.c
--- a/drivers/mtd/devices/lart.c~mtd-jffs2-fix-read-buffer-overflow
+++ a/drivers/mtd/devices/lart.c
@@ -393,7 +393,8 @@ static int flash_erase (struct mtd_info
* erase range is aligned with the erase size which is in
* effect here.
*/
- if (instr->addr & (mtd->eraseregions[i].erasesize - 1)) return (-EINVAL);
+ if (i < 0 || (instr->addr & (mtd->eraseregions[i].erasesize - 1)))
+ return -EINVAL;
/* Remember the erase region we start on */
first = i;
@@ -409,7 +410,8 @@ static int flash_erase (struct mtd_info
i--;
/* is the end aligned on a block boundary? */
- if ((instr->addr + instr->len) & (mtd->eraseregions[i].erasesize - 1)) return (-EINVAL);
+ if (i < 0 || ((instr->addr + instr->len) & (mtd->eraseregions[i].erasesize - 1)))
+ return -EINVAL;
addr = instr->addr;
len = instr->len;
_
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2009-09-18 19:51 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2009-09-18 19:51 [patch 09/13] mtd/jffs2: fix read buffer overflow akpm
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.