[PATCH] mtd: parsers: redboot: reject unterminated FIS names
Miquel Raynal
miquel.raynal at bootlin.com
Fri Jul 3 06:49:01 PDT 2026
On Wed, 01 Jul 2026 13:39:09 +0800, Pengpeng Hou wrote:
> RedBoot FIS partition names are stored in a fixed 16-byte field that is
> expected to be NUL-terminated. parse_redboot_partitions() used strlen()
> to size the names area and later copied the same field with strcpy(), so
> a malformed table entry without a terminator could make both operations
> read beyond the descriptor.
>
> Validate each accepted FIS name with strnlen() before adding it to the
> partition list.
>
> [...]
Applied to nand/next, thanks!
[1/1] mtd: parsers: redboot: reject unterminated FIS names
commit: adfc275b317c02cd043b0cf28b8cfb7459b041f0
Patche(s) should be available on mtd/linux.git and will be
part of the next PR (provided that no robot complains by then).
Kind regards,
Miquèl
More information about the linux-mtd
mailing list