Commit 108ebcd8 authored Feb 26, 2014 by Rafał Miłecki Committed by Brian Norris Mar 10, 2014

mtd: bcm47xxpart: avoid overflowing when registering trx



Our code parsing "trx" header registers few partitions at once (in one
loop iteration). Add extra check in that place.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>

parent 00b79860

drivers/mtd/bcm47xxpart.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -147,6 +147,11 @@ static int bcm47xxpart_parse(struct mtd_info *master,

		/* TRX */
		if (buf[0x000 / 4] == TRX_MAGIC) {
		if (BCM47XXPART_MAX_PARTS - curr_part < 4) {
		pr_warn("Not enough partitions left to register trx, scanning stopped!\n");
		break;
		}

		trx = (struct trx_header *)buf;

		trx_part = curr_part;