[OSS-Tools] [PATCH dt-utils 05/13] state: check length

["Ulrich Ölmann" <u.oelmann@pengutronix.de>]

This ports the following barebox commit:

| commit 9271182f3b32d41a83ca802a63580c0c4fef9b9e
| Author: Jan Remmet <j.remmet@phytec.de>
| Date:   Thu May 23 09:49:00 2019 +0200
|
|     common: state: check length
|
|     if written_length is read from a partial written bucket it may be to
|     big and xmalloc will panic barebox.
|
|     Check if the value is sane. Make read_len unsigned to avoid negative
|     values.
|
|     Signed-off-by: Jan Remmet <j.remmet@phytec.de>
|     Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
---
 src/barebox-state/backend_bucket_direct.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/barebox-state/backend_bucket_direct.c b/src/barebox-state/backend_bucket_direct.c
index 7e83578edb0d..5b5506be002e 100644
--- a/src/barebox-state/backend_bucket_direct.c
+++ b/src/barebox-state/backend_bucket_direct.c
@@ -52,7 +52,7 @@ static int state_backend_bucket_direct_read(struct state_backend_storage_bucket
 	struct state_backend_storage_bucket_direct *direct =
 	    get_bucket_direct(bucket);
 	struct state_backend_storage_bucket_direct_meta meta;
-	ssize_t read_len;
+	uint32_t read_len;
 	void *buf;
 	int ret;
 
@@ -67,6 +67,11 @@ static int state_backend_bucket_direct_read(struct state_backend_storage_bucket
 	}
 	if (meta.magic == direct_magic) {
 		read_len = meta.written_length;
+		if (read_len > direct->max_size) {
+			dev_err(direct->dev, "Wrong length in meta data\n");
+			return -EINVAL;
+
+		}
 	} else {
 		if (meta.magic != ~0 && !!meta.magic)
 			bucket->wrong_magic = 1;
-- 
2.23.0


_______________________________________________
OSS-Tools mailing list
OSS-Tools@pengutronix.de