diff options
| author | Stefano Babic <sbabic@denx.de> | 2010-10-20 08:51:45 +0200 |
|---|---|---|
| committer | Wolfgang Denk <wd@denx.de> | 2010-10-20 09:14:38 +0200 |
| commit | 11c8dd36edcc82564a19dbd0103302df66d66db0 (patch) | |
| tree | b2e6607a5d313a9185d8c1f961b4a9f50a1c6a38 /fs/fat | |
| parent | 70994c79caec0b0304aa87d9695c79f1862ea340 (diff) | |
| download | talos-obmc-uboot-11c8dd36edcc82564a19dbd0103302df66d66db0.tar.gz talos-obmc-uboot-11c8dd36edcc82564a19dbd0103302df66d66db0.zip | |
FAT: buffer overflow with FAT12/16
Last commit 3831530dcb7b71329c272ccd6181f8038b6a6dd0a was intended
"explicitly specify FAT12/16 root directory parsing buffer size, instead
of relying on cluster size". Howver, the underlying function requires
the size of the buffer in blocks, not in bytes, and instead of passing
a double sector size a request for 1024 blocks is sent. This generates
a buffer overflow with overwriting of other structure (in the case seen,
USB structures were overwritten).
Signed-off-by: Stefano Babic <sbabic@denx.de>
CC: Mikhail Zolotaryov <lebon@lebon.org.ua>
Diffstat (limited to 'fs/fat')
| -rw-r--r-- | fs/fat/fat.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/fs/fat/fat.c b/fs/fat/fat.c index 744e961847..a75e4f258a 100644 --- a/fs/fat/fat.c +++ b/fs/fat/fat.c @@ -858,7 +858,7 @@ do_fat_read (const char *filename, void *buffer, unsigned long maxsize, if (disk_read(cursect, (mydata->fatsize == 32) ? (mydata->clust_size) : - LINEAR_PREFETCH_SIZE, + LINEAR_PREFETCH_SIZE / SECTOR_SIZE, do_fat_read_block) < 0) { debug("Error: reading rootdir block\n"); return -1; |
