From: "Ulrich Ölmann" <u.oelmann@pengutronix.de> To: Pengutronix Public Open-Source-Development <oss-tools@pengutronix.de> Cc: "Ulrich Ölmann" <u.oelmann@pengutronix.de> Subject: [OSS-Tools] [PATCH dt-utils 05/13] state: check length Date: Mon, 30 Sep 2019 09:26:05 +0200 [thread overview] Message-ID: <20190930072613.17956-6-u.oelmann@pengutronix.de> (raw) In-Reply-To: <20190930072613.17956-1-u.oelmann@pengutronix.de> This ports the following barebox commit: | commit 9271182f3b32d41a83ca802a63580c0c4fef9b9e | Author: Jan Remmet <j.remmet@phytec.de> | Date: Thu May 23 09:49:00 2019 +0200 | | common: state: check length | | if written_length is read from a partial written bucket it may be to | big and xmalloc will panic barebox. | | Check if the value is sane. Make read_len unsigned to avoid negative | values. | | Signed-off-by: Jan Remmet <j.remmet@phytec.de> | Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de> --- src/barebox-state/backend_bucket_direct.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/src/barebox-state/backend_bucket_direct.c b/src/barebox-state/backend_bucket_direct.c index 7e83578edb0d..5b5506be002e 100644 --- a/src/barebox-state/backend_bucket_direct.c +++ b/src/barebox-state/backend_bucket_direct.c @@ -52,7 +52,7 @@ static int state_backend_bucket_direct_read(struct state_backend_storage_bucket struct state_backend_storage_bucket_direct *direct = get_bucket_direct(bucket); struct state_backend_storage_bucket_direct_meta meta; - ssize_t read_len; + uint32_t read_len; void *buf; int ret; @@ -67,6 +67,11 @@ static int state_backend_bucket_direct_read(struct state_backend_storage_bucket } if (meta.magic == direct_magic) { read_len = meta.written_length; + if (read_len > direct->max_size) { + dev_err(direct->dev, "Wrong length in meta data\n"); + return -EINVAL; + + } } else { if (meta.magic != ~0 && !!meta.magic) bucket->wrong_magic = 1; -- 2.23.0 _______________________________________________ OSS-Tools mailing list OSS-Tools@pengutronix.de
next prev parent reply other threads:[~2019-09-30 7:26 UTC|newest] Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top 2019-09-30 7:26 [OSS-Tools] [PATCH dt-utils 00/13] Harmonize dt-utils' and barebox' shared code base Ulrich Ölmann 2019-09-30 7:26 ` [OSS-Tools] [PATCH dt-utils 01/13] state: Fix lseek error check in state_backend_bucket_direct_read() Ulrich Ölmann 2019-09-30 7:26 ` [OSS-Tools] [PATCH dt-utils 02/13] state: Fix lseek error check in state_backend_bucket_direct_write() Ulrich Ölmann 2019-09-30 7:26 ` [OSS-Tools] [PATCH dt-utils 03/13] state: Fix lseek error check in state_mtd_peb_read() Ulrich Ölmann 2019-09-30 7:26 ` [OSS-Tools] [PATCH dt-utils 04/13] state: Fix lseek error check in state_mtd_peb_write() Ulrich Ölmann 2019-09-30 7:26 ` Ulrich Ölmann [this message] 2019-09-30 7:26 ` [OSS-Tools] [PATCH dt-utils 06/13] state: backend_bucket_circular: mark block as bad if mtd_peb_torture() failed Ulrich Ölmann 2019-09-30 7:26 ` [OSS-Tools] [PATCH dt-utils 07/13] state: drop unused code and declarations for non-existing functions Ulrich Ölmann 2019-09-30 7:26 ` [OSS-Tools] [PATCH dt-utils 08/13] state: keep backward compatibility Ulrich Ölmann 2019-10-22 9:46 ` Roland Hieber 2019-09-30 7:26 ` [OSS-Tools] [PATCH dt-utils 09/13] state: backend_storage: harmonize code with barebox Ulrich Ölmann 2019-09-30 7:26 ` [OSS-Tools] [PATCH dt-utils 10/13] state: " Ulrich Ölmann 2019-09-30 7:26 ` [OSS-Tools] [PATCH dt-utils 11/13] " Ulrich Ölmann 2019-09-30 7:26 ` [OSS-Tools] [PATCH dt-utils 12/13] configure: remove build time option '--disable-logging' Ulrich Ölmann 2019-09-30 7:26 ` [OSS-Tools] [PATCH dt-utils 13/13] configure: remove build time option '--enable-debug' Ulrich Ölmann
Reply instructions: You may reply publicly to this message via plain-text email using any one of the following methods: * Save the following mbox file, import it into your mail client, and reply-to-all from there: mbox Avoid top-posting and favor interleaved quoting: https://en.wikipedia.org/wiki/Posting_style#Interleaved_style * Reply using the --to, --cc, and --in-reply-to switches of git-send-email(1): git send-email \ --in-reply-to=20190930072613.17956-6-u.oelmann@pengutronix.de \ --to=u.oelmann@pengutronix.de \ --cc=oss-tools@pengutronix.de \ --subject='Re: [OSS-Tools] [PATCH dt-utils 05/13] state: check length' \ /path/to/YOUR_REPLY https://kernel.org/pub/software/scm/git/docs/git-send-email.html * If your mail client supports setting the In-Reply-To header via mailto: links, try the mailto: link
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox