In fis_remap(), when desc < last, the memset size is computed as
'tmp - end'. Since tmp is calculated as 'end - positive_value', tmp is
always less than end, making 'tmp - end' negative. When cast to size_t,
this wraps to a very large value, causing a massive buffer overflow.
Fix by swapping the operands to 'end - tmp' which correctly computes the
number of bytes to clear.
Signed-off-by: Anna Kiri <bredcorn@gmail.com>
Link: https://github.com/openwrt/openwrt/pull/23550
Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>
dd62e3af15