diff options
| author | Pengpeng Hou <pengpeng@iscas.ac.cn> | 2026-07-01 13:39:09 +0800 |
|---|---|---|
| committer | Miquel Raynal <miquel.raynal@bootlin.com> | 2026-07-03 15:48:08 +0200 |
| commit | adfc275b317c02cd043b0cf28b8cfb7459b041f0 (patch) | |
| tree | fb3448e22fadef80ca5b1c5c2d0bcdac2e6275b2 /drivers/mtd | |
| parent | 591b5ac17301acfbc8204dfa377353f2b20efc5b (diff) | |
| download | linux-next-adfc275b317c02cd043b0cf28b8cfb7459b041f0.tar.gz linux-next-adfc275b317c02cd043b0cf28b8cfb7459b041f0.zip | |
mtd: parsers: redboot: reject unterminated FIS names
RedBoot FIS partition names are stored in a fixed 16-byte field that is
expected to be NUL-terminated. parse_redboot_partitions() used strlen()
to size the names area and later copied the same field with strcpy(), so
a malformed table entry without a terminator could make both operations
read beyond the descriptor.
Validate each accepted FIS name with strnlen() before adding it to the
partition list.
Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
Signed-off-by: Miquel Raynal <miquel.raynal@bootlin.com>
Diffstat (limited to 'drivers/mtd')
| -rw-r--r-- | drivers/mtd/parsers/redboot.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/drivers/mtd/parsers/redboot.c b/drivers/mtd/parsers/redboot.c index bf162c44eafe..120b2eab21fc 100644 --- a/drivers/mtd/parsers/redboot.c +++ b/drivers/mtd/parsers/redboot.c @@ -192,6 +192,7 @@ nogood: for (i = 0; i < numslots; i++) { struct fis_list *new_fl, **prev; + size_t name_len; if (buf[i].name[0] == 0xff) { if (buf[i].name[1] == 0xff) { @@ -203,8 +204,14 @@ nogood: if (!redboot_checksum(&buf[i])) break; + name_len = strnlen(buf[i].name, sizeof(buf[i].name)); + if (name_len == sizeof(buf[i].name)) { + ret = -EINVAL; + goto out; + } + new_fl = kmalloc_obj(struct fis_list); - namelen += strlen(buf[i].name) + 1; + namelen += name_len + 1; if (!new_fl) { ret = -ENOMEM; goto out; |