Skip to content

Commit

Permalink
UBI: Validate data_size
Browse files Browse the repository at this point in the history
commit 281fda27673f833a01d516658a64d22a32c8e072 upstream.

Make sure that data_size is less than LEB size.
Otherwise a handcrafted UBI image is able to trigger
an out of bounds memory access in ubi_compare_lebs().

Signed-off-by: Richard Weinberger <[email protected]>
Reviewed-by: David Gstir <[email protected]>
[lizf: Backported to 3.4: use dbg_err() instead of ubi_err()];
Signed-off-by: Zefan Li <[email protected]>
  • Loading branch information
richardweinberger authored and lizf-os committed Apr 27, 2016
1 parent 9ed559d commit 15acb36
Showing 1 changed file with 5 additions and 0 deletions.
5 changes: 5 additions & 0 deletions drivers/mtd/ubi/io.c
Original file line number Diff line number Diff line change
Expand Up @@ -942,6 +942,11 @@ static int validate_vid_hdr(const struct ubi_device *ubi,
goto bad;
}

if (data_size > ubi->leb_size) {
dbg_err("bad data_size");
goto bad;
}

if (vol_type == UBI_VID_STATIC) {
/*
* Although from high-level point of view static volumes may
Expand Down

0 comments on commit 15acb36

Please sign in to comment.