[PATCH mtd-utils] ubi-utils: FIX DIVISION BY ZERO in ubinize.c
Anton Moryakov
ant.v.moryakov at gmail.com
Tue Dec 17 06:00:06 PST 2024
Report of the static analyzer:
Variable vi->alignment, whose possible value set allows a zero value at ubinize.c:375, is used as a denominator at ubinize.c:410.
If you look at the code more closely, it will be clear that the vi->alignment parameter is obtained from an external file passed as a command line argument.
A check was also performed if you pass a test.ini file of the following type to the input:
[jffs2-volume]
mode=ubi
image=../jffs2.img
vol_id=1
vol_size=30MiB
vol_type=dynamic
vol_name=jffs2_volume
vol_flags=autoresize
vol_alignment=0
and execute the command:
./ubinize -o ubi.img -p 16KiB -m 512 -s 256 test.ini
we will get the result:
Floating point exception (core dumped)
Corrections explained:
Triggers found by static analyzer Svace.
Signed-off-by: Anton Moryakov <ant.v.moryakov at gmail.com>
---
ubi-utils/ubinize.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/ubi-utils/ubinize.c b/ubi-utils/ubinize.c
index ac8c1e5..afffaa0 100644
--- a/ubi-utils/ubinize.c
+++ b/ubi-utils/ubinize.c
@@ -406,6 +406,14 @@ static int read_section(const struct ubigen_info *ui, const char *sname,
}
}
+
+ /* Validate alignment to avoid division by zero */
+ if (vi->alignment <= 0) {
+ fprintf(stderr, "Error: alignment value (%d) is invalid. It must be greater than 0.\n", vi->alignment);
+ vi->alignment = 1; /* Set a safe default value */
+ fprintf(stderr, "Warning: alignment set to default value (1).\n");
+ }
+
/* Initialize the rest of the volume information */
vi->data_pad = ui->leb_size % vi->alignment;
vi->usable_leb_size = ui->leb_size - vi->data_pad;
--
2.30.2
More information about the linux-mtd
mailing list