mail archive of the barebox mailing list
 help / color / mirror / Atom feed
From: Marc Kleine-Budde <mkl@pengutronix.de>
To: barebox@lists.infradead.org
Subject: [PATCH 8/9] state: backend_raw: add sanity check of data_len during load
Date: Tue, 26 May 2015 13:37:52 +0200	[thread overview]
Message-ID: <1432640273-3895-9-git-send-email-mkl@pengutronix.de> (raw)
In-Reply-To: <1432640273-3895-1-git-send-email-mkl@pengutronix.de>

The length of the data must fit into the remaining available space until the
next copy of the data.

Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
---
 common/state.c | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/common/state.c b/common/state.c
index 8f6d14c98255..4a1e935a3b86 100644
--- a/common/state.c
+++ b/common/state.c
@@ -1053,14 +1053,18 @@ static int backend_raw_load_one(struct state_backend_raw *backend_raw,
 	uint32_t crc;
 	struct state_variable *sv;
 	struct backend_raw_header header = {};
+	unsigned long max_len;
 	int ret;
 	void *buf;
 
+	max_len = backend_raw->stride;
+
 	ret = lseek(fd, offset, SEEK_SET);
 	if (ret < 0)
 		return ret;
 
 	ret = read_full(fd, &header, sizeof(header));
+	max_len -= sizeof(header);
 	if (ret < 0)
 		return ret;
 
@@ -1079,6 +1083,13 @@ static int backend_raw_load_one(struct state_backend_raw *backend_raw,
 		return -EINVAL;
 	}
 
+	if (header.data_len > max_len) {
+		dev_err(&state->dev,
+			"invalid data_len %u in header, max is %lu\n",
+			header.data_len, max_len);
+		return -EINVAL;
+	}
+
 	buf = xzalloc(header.data_len);
 
 	ret = read_full(fd, buf, header.data_len);
-- 
2.1.4


_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox

  parent reply	other threads:[~2015-05-26 11:38 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2015-05-26 11:37 [PATCH 0/9] state: updates and cleanups to make code better sharable with linux Marc Kleine-Budde
2015-05-26 11:37 ` [PATCH 1/9] state: mtd_get_meminfo: open path readonly instead of readwrite Marc Kleine-Budde
2015-05-26 11:37 ` [PATCH 2/9] state: mtd_get_meminfo: make usage of mtd's meminfo compatible to linux Marc Kleine-Budde
2015-05-26 11:37 ` [PATCH 3/9] state: backend_raw: remove hard coded limit of two copies Marc Kleine-Budde
2015-05-26 11:37 ` [PATCH 4/9] state: backend_raw: rename struct state_backend_raw::step -> stride Marc Kleine-Budde
2015-05-26 11:37 ` [PATCH 5/9] state: backend_raw: properly align write and erase size Marc Kleine-Budde
2015-05-26 11:37 ` [PATCH 6/9] state: backend_raw: factor out state_backend_raw_file_get_size() into separate function Marc Kleine-Budde
2015-05-26 11:37 ` [PATCH 7/9] state: backend_raw: rename backend_raw_write_one() -> backend_raw_save_one() Marc Kleine-Budde
2015-05-26 11:37 ` Marc Kleine-Budde [this message]
2015-05-26 11:37 ` [PATCH 9/9] state: backend_raw: update documentation of struct state_backend_raw members Marc Kleine-Budde
2015-05-26 12:33 ` [PATCH 0/9] state: updates and cleanups to make code better sharable with linux Sascha Hauer

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=1432640273-3895-9-git-send-email-mkl@pengutronix.de \
    --to=mkl@pengutronix.de \
    --cc=barebox@lists.infradead.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox