[PATCH] [MTD-UTILS] Incorrect loop condition
Nahor
nahor.j+gmane at gmail.com
Wed Jun 3 21:18:25 EDT 2009
Hi all,
Here is a small patch to fix an obvious typo.
If the file contains only a few bytes in the last page and the padding
option is selected, the loop may exit early (readlen < meminfo.oobsize).
Most of the time it will still work though because the code tries to
read the whole OOB in one chunk.
On a similar issue, shouldn't the loop reading the input file exit with
error if cnt == 0? The loop should alread exit when all the expected
data is read. So if cnt == 0, it means that nandwrite didn't get all the
data it wanted. The code then goes on as if everything was correctly
read so it will write the data from the previous page. This is a
security risk (even though the necessary conditions make it nearly
impossible in practice).
Regards,
Nahor
--- a/nandwrite.c 2009-06-01 18:03:55.000000000 -0700
+++ b/nandwrite.c 2009-06-03 15:29:24.000000000 -0700
@@ -531,7 +531,7 @@
if (writeoob) {
int tinycnt = 0;
- while(tinycnt < readlen) {
+ while(tinycnt < meminfo.oobsize) {
cnt = read(ifd, oobreadbuf + tinycnt,
meminfo.oobsize - tinycnt);
if (cnt == 0) { // EOF
break;
More information about the linux-mtd
mailing list