diff options
| author | Jianan Huang <jnhuang95@gmail.com> | 2024-06-05 14:05:54 +0000 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2024-06-14 12:59:06 -0600 |
| commit | 2c9690e79c76807468e34f34d2065ade2d727227 (patch) | |
| tree | 947bb52b825ca3349ed634cfcc0f31169fe0f873 | |
| parent | 49c046802568863e751971785421baec62f346e5 (diff) | |
| download | u-boot-2c9690e79c76807468e34f34d2065ade2d727227.tar.gz u-boot-2c9690e79c76807468e34f34d2065ade2d727227.tar.bz2 u-boot-2c9690e79c76807468e34f34d2065ade2d727227.zip | |
fs/erofs: fix an overflow issue of unmapped extents
Here the size should be `length - skip`, otherwise it could cause
the destination buffer overflow.
Reported-by: jianqiang wang <wjq.sec@gmail.com>
Fixes: 65cb73057b65 ("fs/erofs: add lz4 decompression support")
Signed-off-by: Jianan Huang <jnhuang95@gmail.com>
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
| -rw-r--r-- | fs/erofs/data.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/erofs/data.c b/fs/erofs/data.c index f4b21d7917..95b609d8ea 100644 --- a/fs/erofs/data.c +++ b/fs/erofs/data.c @@ -313,7 +313,7 @@ static int z_erofs_read_data(struct erofs_inode *inode, char *buffer, } if (!(map.m_flags & EROFS_MAP_MAPPED)) { - memset(buffer + end - offset, 0, length); + memset(buffer + end - offset, 0, length - skip); end = map.m_la; continue; } |