mtd: mtdconcat: prevent a read from eraseregions[-1]

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=ebf2e93036907fe2a7ddab942aa63d35f97f3b2b
Commit:     ebf2e93036907fe2a7ddab942aa63d35f97f3b2b
Parent:     4c1e6b2ce13b154a4a69cee220c98976f4b784df
Author:     Roel Kluin <roel.kluin at gmail.com>
AuthorDate: Fri Sep 18 12:51:49 2009 -0700
Committer:  David Woodhouse <David.Woodhouse at intel.com>
CommitDate: Sat Sep 19 11:18:46 2009 -0700

    mtd: mtdconcat: prevent a read from eraseregions[-1]
    
    If the erase region was found in the first iteration we read from
    eraseregions[-1]
    
    Signed-off-by: Roel Kluin <roel.kluin at gmail.com>
    Signed-off-by: Andrew Morton <akpm at linux-foundation.org>
    Signed-off-by: David Woodhouse <David.Woodhouse at intel.com>
---
 drivers/mtd/mtdconcat.c |    6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/mtdconcat.c b/drivers/mtd/mtdconcat.c
index 792b547..db6de74 100644
--- a/drivers/mtd/mtdconcat.c
+++ b/drivers/mtd/mtdconcat.c
@@ -427,7 +427,7 @@ static int concat_erase(struct mtd_info *mtd, struct erase_info *instr)
 		 * to-be-erased area begins. Verify that the starting
 		 * offset is aligned to this region's erase size:
 		 */
-		if (instr->addr & (erase_regions[i].erasesize - 1))
+		if (i < 0 || instr->addr & (erase_regions[i].erasesize - 1))
 			return -EINVAL;
 
 		/*
@@ -440,8 +440,8 @@ static int concat_erase(struct mtd_info *mtd, struct erase_info *instr)
 		/*
 		 * check if the ending offset is aligned to this region's erase size
 		 */
-		if ((instr->addr + instr->len) & (erase_regions[i].erasesize -
-						  1))
+		if (i < 0 || ((instr->addr + instr->len) &
+					(erase_regions[i].erasesize - 1)))
 			return -EINVAL;
 	}