mtd: bcm47xxpart: avoid overflowing when registering trx
authorRafał Miłecki <zajec5@gmail.com>
Wed, 26 Feb 2014 13:30:34 +0000 (14:30 +0100)
committerBrian Norris <computersforpeace@gmail.com>
Tue, 11 Mar 2014 05:42:29 +0000 (22:42 -0700)
Our code parsing "trx" header registers few partitions at once (in one
loop iteration). Add extra check in that place.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
drivers/mtd/bcm47xxpart.c

index e388e69d853e9a68d5d17ec170a14d07da68583f..23d712209b98d5567de338d2ecadcdd197fb549d 100644 (file)
@@ -147,6 +147,11 @@ static int bcm47xxpart_parse(struct mtd_info *master,
 
                /* TRX */
                if (buf[0x000 / 4] == TRX_MAGIC) {
+                       if (BCM47XXPART_MAX_PARTS - curr_part < 4) {
+                               pr_warn("Not enough partitions left to register trx, scanning stopped!\n");
+                               break;
+                       }
+
                        trx = (struct trx_header *)buf;
 
                        trx_part = curr_part;