imrcpan/erofs-linux
1
0 Fork 0
mirror of git://git.kernel.org/pub/scm/linux/kernel/git/xiang/erofs.git synced 2026-10-29 13:23:23 +01:00
Code Issues Packages Projects Releases Wiki Activity

software node: Correct a OOB check in software_node_get_reference_args()

Browse Source 
software_node_get_reference_args() wants to get @index-th element, so
the property value requires at least '(index + 1) * sizeof(*ref)' bytes
but that can not be guaranteed by current OOB check, and may cause OOB
for malformed property.

Fix by using as OOB check '((index + 1) * sizeof(*ref) > prop->length)'.

Reviewed-by: Sakari Ailus <[email protected]>
Signed-off-by: Zijun Hu <[email protected]>
Link: https://lore.kernel.org/r/[email protected]
Signed-off-by: Greg Kroah-Hartman <[email protected]>
This commit is contained in:
Zijun Hu authored and Greg Kroah-Hartman committed 2025-04-15 18:24:16 +02:00
1 parent f407a8a28a
commit 31e4e12e0e
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
drivers/base/swnode.c
+1 -1
View File
@@ -529,7 +529,7 @@ software_node_get_reference_args(const struct fwnode_handle *fwnode,
if (prop->is_inline)
return -EINVAL;
if (index * sizeof(*ref) >= prop->length)
if ((index + 1) * sizeof(*ref) > prop->length)
return -ENOENT;
ref_array = prop->pointer;