Browse Source

cbfs: Check offset range when reading a file

Add a check that the offset is within the allowed range.

Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Coverity (CID: 331155)
Simon Glass 3 years ago
parent
commit
99eaf1fcaa
1 changed files with 2 additions and 0 deletions
  1. 2 0
      fs/cbfs/cbfs.c

+ 2 - 0
fs/cbfs/cbfs.c

@@ -167,6 +167,8 @@ static int file_cbfs_next_file(struct cbfs_priv *priv, void *start, int size,
 		}
 
 		swap_file_header(&header, file_header);
+		if (header.offset >= size)
+			return log_msg_ret("range", -E2BIG);
 		ret = fill_node(node, start, &header);
 		if (ret) {
 			priv->result = CBFS_BAD_FILE;