Richard Weinberger 552b532540 ubi: Fix out of bounds write in volume update code ...

commit e4f6daac20 upstream.

ubi_start_leb_change() allocates too few bytes.
ubi_more_leb_change_data() will write up to req->upd_bytes +
ubi->min_io_size bytes.

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Boris Brezillon <boris.brezillon@free-electrons.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

2016-03-09 15:31:56 -08:00

..

chips

…

devices

…

lpddr

…

maps

mtd: dc21285: use raw spinlock functions for nw_gpio_lock

2015-08-03 09:29:41 -07:00

nand

mtd: nand: omap: Fix 1-bit Hamming code scheme, omap_calculate_ecc()

2014-09-17 09:04:02 -07:00

onenand

…

tests

…

ubi

ubi: Fix out of bounds write in volume update code

2016-03-09 15:31:56 -08:00

afs.c

…

ar7part.c

…

bcm47xxpart.c

…

bcm63xxpart.c

…

cmdlinepart.c

…

ftl.c

mtd/ftl: fix the double free of the buffers allocated in build_maps()

2014-09-17 09:04:02 -07:00

inftlcore.c

…

inftlmount.c

…

Kconfig

…

Makefile

…

mtd_blkdevs.c

mtd: fix: avoid race condition when accessing mtd->usecount

2015-08-03 09:29:41 -07:00

mtdblock_ro.c

…

mtdblock.c

…

mtdchar.c

…

mtdconcat.c

…

mtdcore.c

…

mtdcore.h

…

mtdoops.c

…

mtdpart.c

mtd: mtdpart: fix add_mtd_partitions error path

2016-02-19 14:22:38 -08:00

mtdsuper.c

…

mtdswap.c

…

nftlcore.c

…

nftlmount.c

…

ofpart.c

…

redboot.c

…

rfd_ftl.c

…

sm_ftl.c

mtd: sm_ftl: heap corruption in sm_create_sysfs_attributes()

2014-05-13 13:59:45 +02:00

sm_ftl.h

…

ssfdc.c

…