mtd: bcm47xxpart: avoid overflowing when registering trx
Our code parsing "trx" header registers few partitions at once (in one
loop iteration). Add extra check in that place.
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Brian Norris <computersforpeace@gmail.com>
diff --git a/drivers/mtd/bcm47xxpart.c b/drivers/mtd/bcm47xxpart.c
index e388e69..23d7122 100644
--- a/drivers/mtd/bcm47xxpart.c
+++ b/drivers/mtd/bcm47xxpart.c
@@ -147,6 +147,11 @@
/* TRX */
if (buf[0x000 / 4] == TRX_MAGIC) {
+ if (BCM47XXPART_MAX_PARTS - curr_part < 4) {
+ pr_warn("Not enough partitions left to register trx, scanning stopped!\n");
+ break;
+ }
+
trx = (struct trx_header *)buf;
trx_part = curr_part;