[PATCH v2 0/2] mtd: spi-nor: sfdp: bound two optional parameter tables

Two of the optional SFDP parameter table parsers size a buffer from the
table length the flash reports, then index it at fixed offsets without
checking the table is long enough.

  spi_nor_parse_profile1()  reads up to DWORD5,  never checks the length
  spi_nor_parse_sccr()      reads up to DWORD22, never checks the length

The spi_nor_parse_4bait() already guards its table this way, so both
patches apply the same check. The two parsers were added at different
times, so they carry different Fixes tags and get one patch each.

Found by code inspection. I have no xSPI or multi-die part to reproduce
this on, so this is not runtime tested.

changes since v1:
 - reworded both commit messages to be more precise
 - renamed the two constants from _DWORD_MAX to _DWORD_MIN
 - Link to v1: https://lore.kernel.org/linux-mtd/[email protected]/

HyeongJun An (2):
  mtd: spi-nor: sfdp: check the length of the xSPI Profile 1.0 table
  mtd: spi-nor: sfdp: check the length of the SCCR map

 drivers/mtd/spi-nor/sfdp.c | 8 ++++++++
 1 file changed, 8 insertions(+)

-- 
2.43.0


______________________________________________________
Linux MTD discussion mailing list
http://lists.infradead.org/mailman/listinfo/linux-mtd/