mtd: bcm47xxpart: avoid overflowing when registering trx

[Linux-MTD Mailing List]

Gitweb:     http://git.infradead.org/?p=mtd-2.6.git;a=commit;h=108ebcd81907cd4818feb3bc1eabcc4a5373da32
Commit:     108ebcd81907cd4818feb3bc1eabcc4a5373da32
Parent:     00b79860eb5f72462016046d3841b19ebff6e846
Author:     Rafał Miłecki <zajec5 at gmail.com>
AuthorDate: Wed Feb 26 14:30:34 2014 +0100
Committer:  Brian Norris <computersforpeace at gmail.com>
CommitDate: Mon Mar 10 22:42:29 2014 -0700

    mtd: bcm47xxpart: avoid overflowing when registering trx
    
    Our code parsing "trx" header registers few partitions at once (in one
    loop iteration). Add extra check in that place.
    
    Signed-off-by: Rafał Miłecki <zajec5 at gmail.com>
    Signed-off-by: Brian Norris <computersforpeace at gmail.com>
---
 drivers/mtd/bcm47xxpart.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/mtd/bcm47xxpart.c b/drivers/mtd/bcm47xxpart.c
index e388e69..23d7122 100644
--- a/drivers/mtd/bcm47xxpart.c
+++ b/drivers/mtd/bcm47xxpart.c
@@ -147,6 +147,11 @@ static int bcm47xxpart_parse(struct mtd_info *master,
 
 		/* TRX */
 		if (buf[0x000 / 4] == TRX_MAGIC) {
+			if (BCM47XXPART_MAX_PARTS - curr_part < 4) {
+				pr_warn("Not enough partitions left to register trx, scanning stopped!\n");
+				break;
+			}
+
 			trx = (struct trx_header *)buf;
 
 			trx_part = curr_part;