[PATCH] ubootvar: reject copies too small for their header

[Ahmad Fatoum]

From: Ahmad Fatoum <a.fatoum at barebox.org>

Probe subtracts the size of the CRC and flag header from the size of
each copy unchecked. For a partition smaller than that, the size wraps
around and the CRC is computed over most of the address space.

Let's fail probe with -EINVAL for such a copy instead.

Fixes: 9fdbd39f320a ("misc: Add a driver to expose U-Boot environment variable data")
Assisted-by: Claude:opus-5.5
Signed-off-by: Ahmad Fatoum <a.fatoum at barebox.org>
---
 drivers/misc/ubootvar.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/misc/ubootvar.c b/drivers/misc/ubootvar.c
index 8c387843bab1..9e2600b5c527 100644
--- a/drivers/misc/ubootvar.c
+++ b/drivers/misc/ubootvar.c
@@ -232,6 +232,13 @@ static int ubootenv_probe(struct device *dev)
 			goto out;
 		}
 
+		if (size[i] < sizeof(uint32_t) + (count > 1)) {
+			dev_err(dev, "U-Boot environment %s is too small\n",
+				ubdata->path[i]);
+			ret = -EINVAL;
+			goto out;
+		}
+
 		crc[i] = *(uint32_t *)data[i];
 
 		size[i] -= sizeof(uint32_t);
-- 
2.47.3