mirror of
https://github.com/u-boot/u-boot.git
synced 2025-04-17 02:15:02 +00:00
35f75d2a46
While zalloc() takes a size_t type, adding 1 to the le32 variable will overflow. A carefully crafted ext4 filesystem can exhibit an inode size of 0xffffffff and as consequence zalloc() will do a zero allocation. Later in the function the inode size is again used for copying data. So an attacker can overwrite memory. Avoid the overflow by using the __builtin_add_overflow() helper. Signed-off-by: Richard Weinberger <richard@nod.at> |
||
|---|---|---|
| .. | ||
| btrfs | ||
| cbfs | ||
| cramfs | ||
| erofs | ||
| ext4 | ||
| fat | ||
| jffs2 | ||
| sandbox | ||
| squashfs | ||
| ubifs | ||
| yaffs2 | ||
| zfs | ||
| fs.c | ||
| fs_internal.c | ||
| Kconfig | ||
| Makefile | ||
| semihostingfs.c | ||