fs/erofs: fix an overflow issue of unmapped extents

Here the size should be `length - skip`, otherwise it could cause
the destination buffer overflow.

Reported-by: jianqiang wang <wjq.sec@gmail.com>
Fixes: 65cb73057b ("fs/erofs: add lz4 decompression support")
Signed-off-by: Jianan Huang <jnhuang95@gmail.com>
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
This commit is contained in:
Jianan Huang 2024-06-05 14:05:54 +00:00 committed by Tom Rini
parent 49c0468025
commit 2c9690e79c

View file

@ -313,7 +313,7 @@ static int z_erofs_read_data(struct erofs_inode *inode, char *buffer,
} }
if (!(map.m_flags & EROFS_MAP_MAPPED)) { if (!(map.m_flags & EROFS_MAP_MAPPED)) {
memset(buffer + end - offset, 0, length); memset(buffer + end - offset, 0, length - skip);
end = map.m_la; end = map.m_la;
continue; continue;
} }