Fix for buffer overflow in ldm_frag_add not sufficient

[karo-tx-linux.git] / fs / partitions / ldm.c

diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
index ce4f624404255f899e1b10262abf3b862aec6be4..a29d5ccf3d54a95099a0ca250f36cbac6dbfba2c 100644 (file)
--- a/fs/partitions/ldm.c
+++ b/fs/partitions/ldm.c
@@ -1335,6 +1335,11 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
 
        list_add_tail (&f->list, frags);
 found:
+       if (rec >= f->num) {
+               ldm_error("REC value (%d) exceeds NUM value (%d)", rec, f->num);
+               return false;
+       }
+
        if (f->map & (1 << rec)) {
                ldm_error ("Duplicate VBLK, part %d.", rec);
                f->map &= 0x7F;                 /* Mark the group as broken */