portugalfuturista/openwrt-pf
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions 2

mtd: fis: fix buffer overflow from negative memset size

Browse source 
In fis_remap(), when desc < last, the memset size is computed as
'tmp - end'. Since tmp is calculated as 'end - positive_value', tmp is
always less than end, making 'tmp - end' negative. When cast to size_t,
this wraps to a very large value, causing a massive buffer overflow.

Fix by swapping the operands to 'end - tmp' which correctly computes the
number of bytes to clear.

Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23550
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
This commit is contained in:
Anna Kiri 2026-05-26 19:10:36 +02:00 committed by Jonas Jelonek
parent 938a43b522
commit dd62e3af15
No known key found for this signature in database
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
package/system/mtd/src/fis.c
View file

@ -215,7 +215,7 @@ fis_remap(struct fis_part *old, int n_old, struct fis_part *new, int n_new)
memmove(desc, last, end - tmp);
if (desc < last) {
tmp = end - (last - desc) * sizeof(struct fis_image_desc);
memset(tmp, 0xff, tmp - end);
memset(tmp, 0xff, end - tmp);
}
}