diff options
| author | Liu Song <liu.song11@zte.com.cn> | 2020-01-16 23:36:07 +0800 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@linuxfoundation.org> | 2020-10-01 13:12:40 +0200 |
| commit | 2e21f66730382ec5898e36633a5f4fa56e35de10 (patch) | |
| tree | 9da077c6082b238540a51a53b74cdc8c6afa1e8f /sound | |
| parent | 64901930e7fbfe74190c1714bbb4fa5f6ce1e992 (diff) | |
| download | linux-stable-2e21f66730382ec5898e36633a5f4fa56e35de10.tar.gz linux-stable-2e21f66730382ec5898e36633a5f4fa56e35de10.tar.bz2 linux-stable-2e21f66730382ec5898e36633a5f4fa56e35de10.zip | |
ubifs: Fix out-of-bounds memory access caused by abnormal value of node_len
[ Upstream commit acc5af3efa303d5f36cc8c0f61716161f6ca1384 ]
In “ubifs_check_node”, when the value of "node_len" is abnormal,
the code will goto label of "out_len" for execution. Then, in the
following "ubifs_dump_node", if inode type is "UBIFS_DATA_NODE",
in "print_hex_dump", an out-of-bounds access may occur due to the
wrong "ch->len".
Therefore, when the value of "node_len" is abnormal, data length
should to be adjusted to a reasonable safe range. At this time,
structured data is not credible, so dump the corrupted data directly
for analysis.
Signed-off-by: Liu Song <liu.song11@zte.com.cn>
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Sasha Levin <sashal@kernel.org>
Diffstat (limited to 'sound')
0 files changed, 0 insertions, 0 deletions