[PATCH] nftl_format: prevent buffer overflow in BadUnitTable access

[PATCH] nftl_format: prevent buffer overflow in BadUnitTable access

[Anton Moryakov]

In the INFTL formatting path, the code iterates over erase blocks from
`pezstart` to `maxzones` (total blocks on device) and accesses
`BadUnitTable[ezone]`. However, `BadUnitTable` is a fixed-size array of
`MAX_ERASE_ZONES` elements (typically 1024 or 4096).

If the MTD device has more erase blocks than `MAX_ERASE_ZONES`,
`ezone` can exceed the array bounds, causing a buffer overflow.

Fix by limiting the loop upper bound to `MIN(maxzones, MAX_ERASE_ZONES)`.

Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>
---
 nand-utils/nftl_format.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/nand-utils/nftl_format.c b/nand-utils/nftl_format.c
index c8b8b50..0d38ddd 100644
--- a/nand-utils/nftl_format.c
+++ b/nand-utils/nftl_format.c
@@ -372,7 +372,8 @@ int main(int argc, char **argv)
 		pezstart = startofs / meminfo.erasesize + 1;
 		pezend = startofs / meminfo.erasesize + ezones - 1;
 		numvunits = (ezones - 2) * PERCENTUSED / 100;
-		for (ezone = pezstart; ezone < maxzones; ezone++) {
+		unsigned long max_iter = (maxzones < MAX_ERASE_ZONES) ? maxzones : MAX_ERASE_ZONES;
+		for (ezone = pezstart; ezone < max_iter; ezone++) {
 			if (BadUnitTable[ezone] != ZONE_GOOD) {
 				if (numvunits > 1)
 					numvunits--;
-- 
2.39.2


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/