Anna Kiri dd62e3af15 mtd: fis: fix buffer overflow from negative memset size ... In fis_remap(), when desc < last, the memset size is computed as 'tmp - end'. Since tmp is calculated as 'end - positive_value', tmp is always less than end, making 'tmp - end' negative. When cast to size_t, this wraps to a very large value, causing a massive buffer overflow. Fix by swapping the operands to 'end - tmp' which correctly computes the number of bytes to clear. Signed-off-by: Anna Kiri <bredcorn@gmail.com> Link: https://github.com/openwrt/openwrt/pull/23550 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>		2026-07-17 10:02:59 +02:00
..
src	mtd: fis: fix buffer overflow from negative memset size	2026-07-17 10:02:59 +02:00
Makefile	mtd: bump package release	2026-06-16 11:32:52 +02:00