[PATCH] mtd: parsers: afs: add size check to v2 partition

[Griffin Kroah-Hartman]

Add a size check to the loop in afs_parse_v2_partition(), avoiding
walking out of the imginfo[] array bounds if a malicious packet fakes a
large region count.

Assisted-by: gkh_clanker_t1000
Signed-off-by: Griffin Kroah-Hartman <griffin at kroah.com>
---
 drivers/mtd/parsers/afs.c | 12 +++++++++---
 1 file changed, 9 insertions(+), 3 deletions(-)

diff --git a/drivers/mtd/parsers/afs.c b/drivers/mtd/parsers/afs.c
index 26116694c821..2c6f8768312c 100644
--- a/drivers/mtd/parsers/afs.c
+++ b/drivers/mtd/parsers/afs.c
@@ -287,12 +287,18 @@ static int afs_parse_v2_partition(struct mtd_info *mtd,
 		 block_start, block_end);
 
 	for (i = 0; i < region_count; i++) {
-		u32 region_load_addr = imginfo[pad + 3 + i*4];
-		u32 region_size = imginfo[pad + 4 + i*4];
-		u32 region_offset = imginfo[pad + 5 + i*4];
+		u32 region_load_addr;
+		u32 region_size;
+		u32 region_offset;
 		u32 region_start;
 		u32 region_end;
 
+		if (pad + 5 + i*4 >= ARRAY_SIZE(imginfo))
+			break;
+		region_load_addr = imginfo[pad + 3 + i*4];
+		region_size = imginfo[pad + 4 + i*4];
+		region_offset = imginfo[pad + 5 + i*4];
+
 		pr_debug("  region %d: address: %08x, size: %08x, "
 			 "offset: %08x\n",
 			 i,

---
base-commit: 8d3ae59288f1e7d58d76558a6ee96d533bc5019f
change-id: 20260824-mtd_break_looper-429d7cf5a7c0

Best regards,
--  
Griffin Kroah-Hartman <griffin at kroah.com>