mailarchive of the pengutronix oss-tools mailing list
 help / color / mirror / Atom feed
From: "Ulrich Ölmann" <u.oelmann@pengutronix.de>
To: Pengutronix Public Open-Source-Development <oss-tools@pengutronix.de>
Cc: "Ulrich Ölmann" <u.oelmann@pengutronix.de>
Subject: [OSS-Tools] [PATCH dt-utils 05/13] state: check length
Date: Mon, 30 Sep 2019 09:26:05 +0200
Message-ID: <20190930072613.17956-6-u.oelmann@pengutronix.de> (raw)
In-Reply-To: <20190930072613.17956-1-u.oelmann@pengutronix.de>

This ports the following barebox commit:

| commit 9271182f3b32d41a83ca802a63580c0c4fef9b9e
| Author: Jan Remmet <j.remmet@phytec.de>
| Date:   Thu May 23 09:49:00 2019 +0200
|
|     common: state: check length
|
|     if written_length is read from a partial written bucket it may be to
|     big and xmalloc will panic barebox.
|
|     Check if the value is sane. Make read_len unsigned to avoid negative
|     values.
|
|     Signed-off-by: Jan Remmet <j.remmet@phytec.de>
|     Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

Signed-off-by: Ulrich Ölmann <u.oelmann@pengutronix.de>
---
 src/barebox-state/backend_bucket_direct.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/barebox-state/backend_bucket_direct.c b/src/barebox-state/backend_bucket_direct.c
index 7e83578edb0d..5b5506be002e 100644
--- a/src/barebox-state/backend_bucket_direct.c
+++ b/src/barebox-state/backend_bucket_direct.c
@@ -52,7 +52,7 @@ static int state_backend_bucket_direct_read(struct state_backend_storage_bucket
 	struct state_backend_storage_bucket_direct *direct =
 	    get_bucket_direct(bucket);
 	struct state_backend_storage_bucket_direct_meta meta;
-	ssize_t read_len;
+	uint32_t read_len;
 	void *buf;
 	int ret;
 
@@ -67,6 +67,11 @@ static int state_backend_bucket_direct_read(struct state_backend_storage_bucket
 	}
 	if (meta.magic == direct_magic) {
 		read_len = meta.written_length;
+		if (read_len > direct->max_size) {
+			dev_err(direct->dev, "Wrong length in meta data\n");
+			return -EINVAL;
+
+		}
 	} else {
 		if (meta.magic != ~0 && !!meta.magic)
 			bucket->wrong_magic = 1;
-- 
2.23.0


_______________________________________________
OSS-Tools mailing list
OSS-Tools@pengutronix.de

  parent reply	other threads:[~2019-09-30  7:26 UTC|newest]

Thread overview: 15+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2019-09-30  7:26 [OSS-Tools] [PATCH dt-utils 00/13] Harmonize dt-utils' and barebox' shared code base Ulrich Ölmann
2019-09-30  7:26 ` [OSS-Tools] [PATCH dt-utils 01/13] state: Fix lseek error check in state_backend_bucket_direct_read() Ulrich Ölmann
2019-09-30  7:26 ` [OSS-Tools] [PATCH dt-utils 02/13] state: Fix lseek error check in state_backend_bucket_direct_write() Ulrich Ölmann
2019-09-30  7:26 ` [OSS-Tools] [PATCH dt-utils 03/13] state: Fix lseek error check in state_mtd_peb_read() Ulrich Ölmann
2019-09-30  7:26 ` [OSS-Tools] [PATCH dt-utils 04/13] state: Fix lseek error check in state_mtd_peb_write() Ulrich Ölmann
2019-09-30  7:26 ` Ulrich Ölmann [this message]
2019-09-30  7:26 ` [OSS-Tools] [PATCH dt-utils 06/13] state: backend_bucket_circular: mark block as bad if mtd_peb_torture() failed Ulrich Ölmann
2019-09-30  7:26 ` [OSS-Tools] [PATCH dt-utils 07/13] state: drop unused code and declarations for non-existing functions Ulrich Ölmann
2019-09-30  7:26 ` [OSS-Tools] [PATCH dt-utils 08/13] state: keep backward compatibility Ulrich Ölmann
2019-10-22  9:46   ` Roland Hieber
2019-09-30  7:26 ` [OSS-Tools] [PATCH dt-utils 09/13] state: backend_storage: harmonize code with barebox Ulrich Ölmann
2019-09-30  7:26 ` [OSS-Tools] [PATCH dt-utils 10/13] state: " Ulrich Ölmann
2019-09-30  7:26 ` [OSS-Tools] [PATCH dt-utils 11/13] " Ulrich Ölmann
2019-09-30  7:26 ` [OSS-Tools] [PATCH dt-utils 12/13] configure: remove build time option '--disable-logging' Ulrich Ölmann
2019-09-30  7:26 ` [OSS-Tools] [PATCH dt-utils 13/13] configure: remove build time option '--enable-debug' Ulrich Ölmann

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20190930072613.17956-6-u.oelmann@pengutronix.de \
    --to=u.oelmann@pengutronix.de \
    --cc=oss-tools@pengutronix.de \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

mailarchive of the pengutronix oss-tools mailing list

This inbox may be cloned and mirrored by anyone:

	git clone --mirror https://lore.pengutronix.de/oss-tools/0 oss-tools/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 oss-tools oss-tools/ https://lore.pengutronix.de/oss-tools \
		oss-tools@pengutronix.de
	public-inbox-index oss-tools

Example config snippet for mirrors.


AGPL code for this site: git clone https://public-inbox.org/public-inbox.git