[OSS-Tools] [PATCH dt-utils 05/13] state: check length

[Ulrich Ölmann]

This ports the following barebox commit:

| commit 9271182f3b32d41a83ca802a63580c0c4fef9b9e
| Author: Jan Remmet <j.rem...@phytec.de>
| Date:   Thu May 23 09:49:00 2019 +0200
|
|     common: state: check length
|
|     if written_length is read from a partial written bucket it may be to
|     big and xmalloc will panic barebox.
|
|     Check if the value is sane. Make read_len unsigned to avoid negative
|     values.
|
|     Signed-off-by: Jan Remmet <j.rem...@phytec.de>
|     Signed-off-by: Sascha Hauer <s.ha...@pengutronix.de>

Signed-off-by: Ulrich Ölmann <u.oelm...@pengutronix.de>
---
 src/barebox-state/backend_bucket_direct.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/barebox-state/backend_bucket_direct.c 
b/src/barebox-state/backend_bucket_direct.c
index 7e83578edb0d..5b5506be002e 100644
--- a/src/barebox-state/backend_bucket_direct.c
+++ b/src/barebox-state/backend_bucket_direct.c
@@ -52,7 +52,7 @@ static int state_backend_bucket_direct_read(struct 
state_backend_storage_bucket
        struct state_backend_storage_bucket_direct *direct =
            get_bucket_direct(bucket);
        struct state_backend_storage_bucket_direct_meta meta;
-       ssize_t read_len;
+       uint32_t read_len;
        void *buf;
        int ret;
 
@@ -67,6 +67,11 @@ static int state_backend_bucket_direct_read(struct 
state_backend_storage_bucket
        }
        if (meta.magic == direct_magic) {
                read_len = meta.written_length;
+               if (read_len > direct->max_size) {
+                       dev_err(direct->dev, "Wrong length in meta data\n");
+                       return -EINVAL;
+
+               }
        } else {
                if (meta.magic != ~0 && !!meta.magic)
                        bucket->wrong_magic = 1;
-- 
2.23.0


_______________________________________________
OSS-Tools mailing list
OSS-Tools@pengutronix.de