Richard Weinberger c5c2ce3560 ubi: Fix out of bounds write in volume update code ...

commit e4f6daac20332448529b11f09388f1d55ef2084c upstream.

ubi_start_leb_change() allocates too few bytes.
ubi_more_leb_change_data() will write up to req->upd_bytes +
ubi->min_io_size bytes.

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2016-03-09 15:34:56 -08:00

..

attach.c

UBI: drop null test before destroy functions

2015-10-03 20:36:10 +02:00

block.c

…

build.c

…

cdev.c

UBI: Remove in vain semicolon

2015-11-06 23:26:51 +01:00

debug.c

UBI: fix return error code

2015-12-16 22:45:04 +01:00

debug.h

…

eba.c

…

fastmap-wl.c

ubi: fastmap: Implement produce_free_peb()

2015-10-03 23:25:30 +02:00

fastmap.c

UBI: Fastmap: Fix PEB array type

2015-11-06 23:26:50 +01:00

gluebi.c

UBI: Update comments to reflect UBI_METAONLY flag

2015-10-03 20:11:59 +02:00

io.c

UBI: fix use of "VID" vs. "EC" in header self-check

2015-12-16 22:46:26 +01:00

kapi.c

…

Kconfig

…

Makefile

…

misc.c

…

ubi-media.h

…

ubi.h

…

upd.c

ubi: Fix out of bounds write in volume update code

2016-03-09 15:34:56 -08:00

vmt.c

…

vtbl.c

…

wl.c

mtd: ubi: don't leak e if schedule_erase() fails

2015-12-16 22:59:03 +01:00

wl.h

…