github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-22 04:34:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

mtd: parsers: redboot: reject unterminated FIS names

Browse Source 
RedBoot FIS partition names are stored in a fixed 16-byte field that is
expected to be NUL-terminated. parse_redboot_partitions() used strlen()
to size the names area and later copied the same field with strcpy(), so
a malformed table entry without a terminator could make both operations
read beyond the descriptor.

Validate each accepted FIS name with strnlen() before adding it to the
partition list.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
This commit is contained in:
Pengpeng Hou 2026-07-01 13:39:09 +08:00 committed by Miquel Raynal
parent 591b5ac173
commit adfc275b31
1 changed files with 8 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

9
drivers/mtd/parsers/redboot.c
View File

@ -192,6 +192,7 @@ static int parse_redboot_partitions(struct mtd_info *master,
for (i = 0; i < numslots; i++) {
struct fis_list *new_fl, **prev;
size_t name_len;
if (buf[i].name[0] == 0xff) {
if (buf[i].name[1] == 0xff) {
@ -203,8 +204,14 @@ static int parse_redboot_partitions(struct mtd_info *master,
if (!redboot_checksum(&buf[i]))
break;
name_len = strnlen(buf[i].name, sizeof(buf[i].name));
if (name_len == sizeof(buf[i].name)) {
ret = -EINVAL;
goto out;
}
new_fl = kmalloc_obj(struct fis_list);
namelen += strlen(buf[i].name) + 1;
namelen += name_len + 1;
if (!new_fl) {
ret = -ENOMEM;
goto out;