summaryrefslogtreecommitdiff
path: root/lib/mpi/mpicoder.c
diff options
context:
space:
mode:
authorHerbert Xu <herbert@gondor.apana.org.au>2022-12-27 17:27:39 +0300
committerHerbert Xu <herbert@gondor.apana.org.au>2023-01-06 12:15:46 +0300
commit7361d1bc307b926cbca214ab67b641123c2d6357 (patch)
tree50edbe327f6014e560ff3e888778f5fe2806c8e6 /lib/mpi/mpicoder.c
parente20d5a22bd241c5084184bcf69dfb6eddc35417f (diff)
downloadlinux-7361d1bc307b926cbca214ab67b641123c2d6357.tar.xz
lib/mpi: Fix buffer overrun when SG is too long
The helper mpi_read_raw_from_sgl sets the number of entries in the SG list according to nbytes. However, if the last entry in the SG list contains more data than nbytes, then it may overrun the buffer because it only allocates enough memory for nbytes. Fixes: 2d4d1eea540b ("lib/mpi: Add mpi sgl helpers") Reported-by: Roberto Sassu <roberto.sassu@huaweicloud.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au> Reviewed-by: Eric Biggers <ebiggers@google.com> Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
Diffstat (limited to 'lib/mpi/mpicoder.c')
-rw-r--r--lib/mpi/mpicoder.c3
1 files changed, 2 insertions, 1 deletions
diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
index 39c4c6731094..3cb6bd148fa9 100644
--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -504,7 +504,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes)
while (sg_miter_next(&miter)) {
buff = miter.addr;
- len = miter.length;
+ len = min_t(unsigned, miter.length, nbytes);
+ nbytes -= len;
for (x = 0; x < len; x++) {
a <<= 8;