The offset (which is 64bits when mtd-utils are not compile with
WITHOUT_LARGEFILE) is calculated like that:
offset = nb * size;
But nb and size are int, so on 32bits platforms, there's a possible
overflow.
So, it should be replace with:
offset = (off_t)nb * size;
If WITHOUT_LARGEFILE is defined, there still be an overflow, but it's
what we want, right ?
Cheney Chen tested an ubiformat on a NAND (5.9 GiB mtd part).
Reported-by: Cheney Chen <cheneychencl2012@gmail.com>
Tested-by: Cheney Chen <cheneychencl2012@gmail.com>
Signed-off-by: Richard Genoud <richard.genoud@gmail.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
memset(outbuf + ui->data_offs + ui->vtbl_size, 0xFF,
ui->peb_size - ui->data_offs - ui->vtbl_size);
- seek = peb1 * ui->peb_size;
+ seek = (off_t) peb1 * ui->peb_size;
if (lseek(fd, seek, SEEK_SET) != seek) {
sys_errmsg("cannot seek output file");
goto out_free;
goto out_free;
}
- seek = peb2 * ui->peb_size;
+ seek = (off_t) peb2 * ui->peb_size;
if (lseek(fd, seek, SEEK_SET) != seek) {
sys_errmsg("cannot seek output file");
goto out_free;