diff options
| author | Rafał Miłecki <zajec5@gmail.com> | 2014-02-26 14:30:34 +0100 |
|---|---|---|
| committer | Brian Norris <computersforpeace@gmail.com> | 2014-03-10 22:42:29 -0700 |
| commit | 108ebcd81907cd4818feb3bc1eabcc4a5373da32 (patch) | |
| tree | e69136542afe80e595d0d2d0a4668875d434cbea /drivers/mtd | |
| parent | 00b79860eb5f72462016046d3841b19ebff6e846 (diff) | |
| download | linux-108ebcd81907cd4818feb3bc1eabcc4a5373da32.tar.bz2 | |
mtd: bcm47xxpart: avoid overflowing when registering trx
Our code parsing "trx" header registers few partitions at once (in one
loop iteration). Add extra check in that place.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
Diffstat (limited to 'drivers/mtd')
| -rw-r--r-- | drivers/mtd/bcm47xxpart.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/mtd/bcm47xxpart.c b/drivers/mtd/bcm47xxpart.c index e388e69d853e..23d712209b98 100644 --- a/drivers/mtd/bcm47xxpart.c +++ b/drivers/mtd/bcm47xxpart.c @@ -147,6 +147,11 @@ static int bcm47xxpart_parse(struct mtd_info *master, /* TRX */ if (buf[0x000 / 4] == TRX_MAGIC) { + if (BCM47XXPART_MAX_PARTS - curr_part < 4) { + pr_warn("Not enough partitions left to register trx, scanning stopped!\n"); + break; + } + trx = (struct trx_header *)buf; trx_part = curr_part; |