ubi-utils: fix memory corruptions

This patch contains changes similar to the ones in the previous
patch.

Also, it changes all invocations of memset and makes sure
the argument is 0, not '\0', because memset expects int,
not char.

Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>

diff --git a/ubi-utils/src/libmtd.c b/ubi-utils/src/libmtd.c
index 046beea6ebdca728de78e5c44565f06c209ba600..b050beabae8038e30790ee6a5f4bf89395f00194 100644 (file)
--- a/ubi-utils/src/libmtd.c
+++ b/ubi-utils/src/libmtd.c
@@ -89,6 +89,14 @@ static int read_data(const char *file, void *buf, int buf_len)
                goto out_error;
        }
 
+       if (rd == buf_len) {
+               errmsg("contents of \"%s\" is too long", file);
+               errno = EINVAL;
+               goto out_error;
+       }
+
+       ((char *)buf)[rd] = '\0';
+
        /* Make sure all data is read */
        tmp1 = read(fd, &tmp, 1);
        if (tmp1 == 1) {
@@ -199,16 +207,17 @@ static int read_hex_ll(const char *file, long long *value)
        if (fd == -1)
                return -1;
 
-       rd = read(fd, buf, 50);
+       rd = read(fd, buf, sizeof(buf));
        if (rd == -1) {
                sys_errmsg("cannot read \"%s\"", file);
                goto out_error;
        }
-       if (rd == 50) {
+       if (rd == sizeof(buf)) {
                errmsg("contents of \"%s\" is too long", file);
                errno = EINVAL;
                goto out_error;
        }
+       buf[rd] = '\0';
 
        if (sscanf(buf, "%llx\n", value) != 1) {
                errmsg("cannot read integer from \"%s\"\n", file);
@@ -571,7 +580,7 @@ int mtd_get_info(libmtd_t desc, struct mtd_info *info)
        struct dirent *dirent;
        struct libmtd *lib = (struct libmtd *)desc;
 
-       memset(info, '\0', sizeof(struct mtd_info));
+       memset(info, 0, sizeof(struct mtd_info));
 
        if (!lib->sysfs_supported)
                return legacy_mtd_get_info(info);
@@ -643,7 +652,7 @@ int mtd_get_dev_info1(libmtd_t desc, int dev_num, struct mtd_dev_info *mtd)
        struct stat st;
        struct libmtd *lib = (struct libmtd *)desc;
 
-       memset(mtd, '\0', sizeof(struct mtd_dev_info));
+       memset(mtd, 0, sizeof(struct mtd_dev_info));
        mtd->dev_num = dev_num;
 
        if (!lib->sysfs_supported)
@@ -663,13 +672,13 @@ int mtd_get_dev_info1(libmtd_t desc, int dev_num, struct mtd_dev_info *mtd)
                return -1;
 
        ret = dev_read_data(lib->mtd_name, dev_num, &mtd->name,
-                           MTD_NAME_MAX);
+                           MTD_NAME_MAX + 1);
        if (ret < 0)
                return -1;
        ((char *)mtd->name)[ret - 1] = '\0';
 
        ret = dev_read_data(lib->mtd_type, dev_num, &mtd->type_str,
-                           MTD_TYPE_MAX);
+                           MTD_TYPE_MAX + 1);
        if (ret < 0)
                return -1;
        ((char *)mtd->type_str)[ret - 1] = '\0';

diff --git a/ubi-utils/src/libubi.c b/ubi-utils/src/libubi.c
index 6f9228e459b21aaa3d7d742333100bffac3617ad..a4313ab7e5fee502bd8171d1918dda502634fd0d 100644 (file)
--- a/ubi-utils/src/libubi.c
+++ b/ubi-utils/src/libubi.c
@@ -166,6 +166,13 @@ static int read_data(const char *file, void *buf, int buf_len)
                sys_errmsg("cannot read \"%s\"", file);
                goto out_error;
        }
+
+       if (rd == buf_len) {
+               errmsg("contents of \"%s\" is too long", file);
+               errno = EINVAL;
+               goto out_error;
+       }
+
        ((char *)buf)[rd] = '\0';
 
        /* Make sure all data is read */
@@ -676,7 +683,7 @@ int ubi_attach_mtd(libubi_t desc, const char *node,
        int fd, ret;
        struct ubi_attach_req r;
 
-       memset(&r, sizeof(struct ubi_attach_req), '\0');
+       memset(&r, 0, sizeof(struct ubi_attach_req));
 
        desc = desc;
        r.ubi_num = req->dev_num;
@@ -806,7 +813,7 @@ int ubi_get_info(libubi_t desc, struct ubi_info *info)
        struct dirent *dirent;
        struct libubi *lib = (struct libubi *)desc;
 
-       memset(info, '\0', sizeof(struct ubi_info));
+       memset(info, 0, sizeof(struct ubi_info));
 
        if (read_major(lib->ctrl_dev, &info->ctrl_major, &info->ctrl_minor)) {
                /*
@@ -881,7 +888,7 @@ int ubi_mkvol(libubi_t desc, const char *node, struct ubi_mkvol_request *req)
        struct ubi_mkvol_req r;
        size_t n;
 
-       memset(&r, sizeof(struct ubi_mkvol_req), '\0');
+       memset(&r, 0, sizeof(struct ubi_mkvol_req));
 
        desc = desc;
        r.vol_id = req->vol_id;
@@ -1034,7 +1041,7 @@ int ubi_get_dev_info1(libubi_t desc, int dev_num, struct ubi_dev_info *info)
        struct dirent *dirent;
        struct libubi *lib = (struct libubi *)desc;
 
-       memset(info, '\0', sizeof(struct ubi_dev_info));
+       memset(info, 0, sizeof(struct ubi_dev_info));
        info->dev_num = dev_num;
 
        if (!dev_present(lib, dev_num))
@@ -1137,7 +1144,7 @@ int ubi_get_vol_info1(libubi_t desc, int dev_num, int vol_id,
        struct libubi *lib = (struct libubi *)desc;
        char buf[50];
 
-       memset(info, '\0', sizeof(struct ubi_vol_info));
+       memset(info, 0, sizeof(struct ubi_vol_info));
        info->dev_num = dev_num;
        info->vol_id = vol_id;
 

diff --git a/ubi-utils/src/libubigen.c b/ubi-utils/src/libubigen.c
index fddc1d8d073029ceefacd43286764f166889bca8..a34963e1a4b5c0c82f02b06694bb151678a2154d 100644 (file)
--- a/ubi-utils/src/libubigen.c
+++ b/ubi-utils/src/libubigen.c
@@ -122,7 +122,7 @@ int ubigen_add_volume(const struct ubigen_info *ui,
                return errmsg("too large alignment %d, max is %d (LEB size)",
                              vi->alignment, ui->leb_size);
 
-       memset(vtbl_rec, '\0', sizeof(struct ubi_vtbl_record));
+       memset(vtbl_rec, 0, sizeof(struct ubi_vtbl_record));
        tmp = (vi->bytes + ui->leb_size - 1) / ui->leb_size;
        vtbl_rec->reserved_pebs = cpu_to_be32(tmp);
        vtbl_rec->alignment = cpu_to_be32(vi->alignment);
@@ -151,7 +151,7 @@ void ubigen_init_ec_hdr(const struct ubigen_info *ui,
 {
        uint32_t crc;
 
-       memset(hdr, '\0', sizeof(struct ubi_ec_hdr));
+       memset(hdr, 0, sizeof(struct ubi_ec_hdr));
 
        hdr->magic = cpu_to_be32(UBI_EC_HDR_MAGIC);
        hdr->version = ui->ubi_ver;
@@ -183,7 +183,7 @@ static void init_vid_hdr(const struct ubigen_info *ui,
 {
        uint32_t crc;
 
-       memset(hdr, '\0', sizeof(struct ubi_vid_hdr));
+       memset(hdr, 0, sizeof(struct ubi_vid_hdr));
 
        hdr->magic = cpu_to_be32(UBI_VID_HDR_MAGIC);
        hdr->version = ui->ubi_ver;