Re: [PATCH] ubifs: fix out-of-bounds read in signature length check
Richard Weinberger <[email protected]> Fri, 24 Jul 2026 11:14:27 +0200 (CEST)
| Newsgroups | org.infradead.lists.linux-mtd,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
LS0tLS0gVXJzcHLDvG5nbGljaGUgTWFpbCAtLS0tLQo+IFZvbjogIklicmFoaW0gSGFzaGltb3Yi IDxzZWN1cml0eUBhdWRpdGNvZGUuYWk+Cj4gQW46ICJyaWNoYXJkIiA8cmljaGFyZEBub2QuYXQ+ Cj4gQ0M6ICJjaGVuZ3poaWhhbzEiIDxjaGVuZ3poaWhhbzFAaHVhd2VpLmNvbT4sICJTYXNjaGEg SGF1ZXIiIDxzLmhhdWVyQHBlbmd1dHJvbml4LmRlPiwgImxpbnV4LW10ZCIKPiA8bGludXgtbXRk QGxpc3RzLmluZnJhZGVhZC5vcmc+LCAibGludXgta2VybmVsIiA8bGludXgta2VybmVsQHZnZXIu a2VybmVsLm9yZz4sICJzdGFibGUiIDxzdGFibGVAdmdlci5rZXJuZWwub3JnPgo+IEdlc2VuZGV0 OiBGcmVpdGFnLCAyNC4gSnVsaSAyMDI2IDA5OjQzOjI3Cj4gQmV0cmVmZjogW1BBVENIXSB1Ymlm czogZml4IG91dC1vZi1ib3VuZHMgcmVhZCBpbiBzaWduYXR1cmUgbGVuZ3RoIGNoZWNrCgo+IHVi aWZzX3NiX3ZlcmlmeV9zaWduYXR1cmUoKSBib3VuZHMgdGhlIG9uLWRpc2sgdWJpZnNfc2lnX25v ZGUtPmxlbiBmaWVsZAo+IGJlZm9yZSBoYW5kaW5nIHRoZSBzaWduYXR1cmUgcGF5bG9hZCB0byB2 ZXJpZnlfcGtjczdfc2lnbmF0dXJlKCksIGJ1dCB0aGUKPiBjaGVjayBoYXMgdGhlIHdyb25nIHNp Z246Cj4gCj4JaWYgKGxlMzJfdG9fY3B1KHNpZ25vZGUtPmxlbikgPiBzbm9kLT5sZW4gKyBzaXpl b2Yoc3RydWN0IHViaWZzX3NpZ19ub2RlKSkKPiAKPiBUaGUgc2lnbmF0dXJlIGJ5dGVzIHN0YXJ0 IHNpemVvZihzdHJ1Y3QgdWJpZnNfc2lnX25vZGUpIChVQklGU19TSUdfTk9ERV9TWiwKPiA2NCBi eXRlcykgaW50byB0aGUgbm9kZSwgc28gdGhlIHBheWxvYWQgaXMgYXQgbW9zdAo+IAo+CXNub2Qt PmxlbiAtIHNpemVvZihzdHJ1Y3QgdWJpZnNfc2lnX25vZGUpCj4gCj4gYnl0ZXMgbG9uZy4gQWRk aW5nIHRoZSBoZWFkZXIgc2l6ZSBpbnN0ZWFkIG9mIHN1YnRyYWN0aW5nIGl0IGFjY2VwdHMgYQo+ IGRlY2xhcmVkIGxlbmd0aCB1cCB0byAyICogVUJJRlNfU0lHX05PREVfU1ogbGFyZ2VyIHRoYW4g dGhlIG5vZGUgYWN0dWFsbHkKPiBob2xkcyAtLSBwYXN0IHRoZSBlbmQgb2YgYy0+c2J1Ziwgd2hp Y2ggaXMgdm1hbGxvYyhjLT5sZWJfc2l6ZSkuCj4gdmVyaWZ5X3BrY3M3X3NpZ25hdHVyZSgpIC0+ IHBrY3M3X3BhcnNlX21lc3NhZ2UoKSAtPiBhc24xX2Jlcl9kZWNvZGVyKCkKPiBpcyB0aGVuIGhh bmRlZCB0aGF0IGluZmxhdGVkIGxlbmd0aCBhbmQgcmVhZHMgYmV5b25kIHRoZSBhbGxvY2F0aW9u IHdoaWxlCj4gd2Fsa2luZyB0aGUgREVSIGhlYWRlcnMuIFRoZSBub2RlIGxlbmd0aCBjb21lcyBz dHJhaWdodCBmcm9tIHRoZSBtb3VudGVkCj4gaW1hZ2UsIHNvIGEgY3JhZnRlZCBzaWduZWQgVUJJ RlMgaW1hZ2UgcmVhY2hlcyB0aGlzIHZpYQo+IHViaWZzX3JlYWRfc3VwZXJibG9jaygpIGJlZm9y ZSB0aGUgc2lnbmF0dXJlIGlzIGNyeXB0b2dyYXBoaWNhbGx5IGNoZWNrZWQuCj4gCj4gc25vZC0+ bGVuIGlzIGd1YXJhbnRlZWQgdG8gYmUgPj0gVUJJRlNfU0lHX05PREVfU1ogYnkgdGhlIG5vZGUg c2Nhbm5lcgo+IChjLT5yYW5nZXNbVUJJRlNfU0lHX05PREVdLm1pbl9sZW4gPT0gVUJJRlNfU0lH X05PREVfU1opLCBzbyB0aGUgY29ycmVjdGVkCj4gc3VidHJhY3Rpb24gY2Fubm90IHVuZGVyZmxv dy4gTGVnaXRpbWF0ZWx5IHNpZ25lZCBpbWFnZXMgYXJlIHVuYWZmZWN0ZWQ6IGEKPiBjb3JyZWN0 IHN1cGVyYmxvY2sgbmV2ZXIgZGVjbGFyZXMgYSBzaWduYXR1cmUgbG9uZ2VyIHRoYW4gdGhlIG5v ZGUgaXQgaXMKPiBlbWJlZGRlZCBpbi4KPiAKPiBGaXhlczogODE3YWEwOTQ4NDJkICgidWJpZnM6 IHN1cHBvcnQgb2ZmbGluZSBzaWduZWQgaW1hZ2VzIikKPiBDYzogc3RhYmxlQHZnZXIua2VybmVs Lm9yZwo+IFNpZ25lZC1vZmYtYnk6IElicmFoaW0gSGFzaGltb3YgPHNlY3VyaXR5QGF1ZGl0Y29k ZS5haT4KPiBBc3Npc3RlZC1ieTogQXVkaXRDb2RlLUFJOjIwMjYuMDcKPiAtLS0KPiBmcy91Ymlm cy9hdXRoLmMgfCAyICstCj4gMSBmaWxlIGNoYW5nZWQsIDEgaW5zZXJ0aW9uKCspLCAxIGRlbGV0 aW9uKC0pCgpSZXZpZXdlZC1ieTogUmljaGFyZCBXZWluYmVyZ2VyIDxyaWNoYXJkQG5vZC5hdD4K ClRoYW5rcywKLy9yaWNoYXJkCgpfX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19f X19fX19fX19fX19fX19fX18KTGludXggTVREIGRpc2N1c3Npb24gbWFpbGluZyBsaXN0Cmh0dHA6 Ly9saXN0cy5pbmZyYWRlYWQub3JnL21haWxtYW4vbGlzdGluZm8vbGludXgtbXRkLwo=