From 68e00caaa70c9cb36d8813d5170f39bd69ae86a8 Mon Sep 17 00:00:00 2001 From: Jason Liu Date: Fri, 19 Nov 2010 16:40:45 +0800 Subject: [PATCH] --- yaml --- r: 231686 b: refs/heads/master c: e14feafbe0d5c6d64bb6fe4eba928cb57ac9a4c8 h: refs/heads/master v: v3 --- [refs] | 2 +- trunk/drivers/mtd/nand/nand_base.c | 9 ++++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/[refs] b/[refs] index d652df359170..eff621eb02f9 100644 --- a/[refs] +++ b/[refs] @@ -1,2 +1,2 @@ --- -refs/heads/master: 1534b8b09757190ce6e97fa97f9ad77c49082cd8 +refs/heads/master: e14feafbe0d5c6d64bb6fe4eba928cb57ac9a4c8 diff --git a/trunk/drivers/mtd/nand/nand_base.c b/trunk/drivers/mtd/nand/nand_base.c index 1f75a1b1f7c3..75d199e4f25b 100644 --- a/trunk/drivers/mtd/nand/nand_base.c +++ b/trunk/drivers/mtd/nand/nand_base.c @@ -1782,6 +1782,13 @@ static int nand_do_read_oob(struct mtd_info *mtd, loff_t from, else len = mtd->oobsize; + /* Do not allow read past end of page */ + if ((ops->ooboffs + readlen) > len) { + DEBUG(MTD_DEBUG_LEVEL0, "%s: Attempt to read " + "past end of page\n", __func__); + return -EINVAL; + } + if (unlikely(ops->ooboffs >= len)) { DEBUG(MTD_DEBUG_LEVEL0, "%s: Attempt to start read " "outside oob\n", __func__); @@ -2377,7 +2384,7 @@ static int nand_do_write_oob(struct mtd_info *mtd, loff_t to, return -EINVAL; } - /* Do not allow reads past end of device */ + /* Do not allow write past end of device */ if (unlikely(to >= mtd->size || ops->ooboffs + ops->ooblen > ((mtd->size >> chip->page_shift) -