diff options
| author | Benedikt Spranger <b.spranger@linutronix.de> | 2025-09-17 11:14:17 +0200 |
|---|---|---|
| committer | Heiko Schocher <hs@nabladev.com> | 2025-10-08 11:34:39 +0200 |
| commit | 88e7a462f05d88bf3b782c3d06903b9cd1c19430 (patch) | |
| tree | c1a0792b405c029bda89e6e73b3c6799c55ce56d | |
| parent | 75b7ef1caf19d467ee8a7e69eb5eccb6a45e1715 (diff) | |
drivers/mtd/ubispl/ubispl.c: limit copy size
The fastmap VID header is embedded in struct ubi_scan_info. During fastmap
scan, the header is copied into struct ubi_scan_info, if valid. The former
code mixed up the amount of copied bytes and copied more bytes than
nessesary. This had no side effect, since the affected struct members are
uninitialized at that point and overwritten later.
Limit the copied bytes to the VID header size.
Signed-off-by: Benedikt Spranger <b.spranger@linutronix.de>
Reported-by: Andrew Goodbody <andrew.goodbody@linaro.org>
| -rw-r--r-- | drivers/mtd/ubispl/ubispl.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/mtd/ubispl/ubispl.c b/drivers/mtd/ubispl/ubispl.c index 9face5fae15..0143caa051d 100644 --- a/drivers/mtd/ubispl/ubispl.c +++ b/drivers/mtd/ubispl/ubispl.c @@ -779,7 +779,7 @@ static int ubi_scan_fastmap(struct ubi_scan_info *ubi, * that already so we merily copy it over. */ if (pnum == fm_anchor) - memcpy(vh, ubi->blockinfo + pnum, sizeof(*fm)); + memcpy(vh, ubi->blockinfo + pnum, sizeof(*vh)); if (i == 0) { if (be32_to_cpu(vh->vol_id) != UBI_FM_SB_VOLUME_ID) { |