Re: [PATCH] ubifs: fix out-of-bounds read in signature length check
Zhihao Cheng <[email protected]> Fri, 24 Jul 2026 18:55:59 +0800
| Newsgroups | org.infradead.lists.linux-mtd,org.kernel.vger.linux-kernel,org.kernel.vger.stable |
|---|---|
| Message-ID | <[email protected]> |
1NogMjAyNi83LzI0IDE1OjQzLCBJYnJhaGltIEhhc2hpbW92INC0tcA6Cj4gdWJpZnNfc2JfdmVy aWZ5X3NpZ25hdHVyZSgpIGJvdW5kcyB0aGUgb24tZGlzayB1Ymlmc19zaWdfbm9kZS0+bGVuIGZp ZWxkCj4gYmVmb3JlIGhhbmRpbmcgdGhlIHNpZ25hdHVyZSBwYXlsb2FkIHRvIHZlcmlmeV9wa2Nz N19zaWduYXR1cmUoKSwgYnV0IHRoZQo+IGNoZWNrIGhhcyB0aGUgd3Jvbmcgc2lnbjoKPiAKPiAJ aWYgKGxlMzJfdG9fY3B1KHNpZ25vZGUtPmxlbikgPiBzbm9kLT5sZW4gKyBzaXplb2Yoc3RydWN0 IHViaWZzX3NpZ19ub2RlKSkKPiAKPiBUaGUgc2lnbmF0dXJlIGJ5dGVzIHN0YXJ0IHNpemVvZihz dHJ1Y3QgdWJpZnNfc2lnX25vZGUpIChVQklGU19TSUdfTk9ERV9TWiwKPiA2NCBieXRlcykgaW50 byB0aGUgbm9kZSwgc28gdGhlIHBheWxvYWQgaXMgYXQgbW9zdAo+IAo+IAlzbm9kLT5sZW4gLSBz aXplb2Yoc3RydWN0IHViaWZzX3NpZ19ub2RlKQo+IAo+IGJ5dGVzIGxvbmcuIEFkZGluZyB0aGUg aGVhZGVyIHNpemUgaW5zdGVhZCBvZiBzdWJ0cmFjdGluZyBpdCBhY2NlcHRzIGEKPiBkZWNsYXJl ZCBsZW5ndGggdXAgdG8gMiAqIFVCSUZTX1NJR19OT0RFX1NaIGxhcmdlciB0aGFuIHRoZSBub2Rl IGFjdHVhbGx5Cj4gaG9sZHMgLS0gcGFzdCB0aGUgZW5kIG9mIGMtPnNidWYsIHdoaWNoIGlzIHZt YWxsb2MoYy0+bGViX3NpemUpLgo+IHZlcmlmeV9wa2NzN19zaWduYXR1cmUoKSAtPiBwa2NzN19w YXJzZV9tZXNzYWdlKCkgLT4gYXNuMV9iZXJfZGVjb2RlcigpCj4gaXMgdGhlbiBoYW5kZWQgdGhh dCBpbmZsYXRlZCBsZW5ndGggYW5kIHJlYWRzIGJleW9uZCB0aGUgYWxsb2NhdGlvbiB3aGlsZQo+ IHdhbGtpbmcgdGhlIERFUiBoZWFkZXJzLiBUaGUgbm9kZSBsZW5ndGggY29tZXMgc3RyYWlnaHQg ZnJvbSB0aGUgbW91bnRlZAo+IGltYWdlLCBzbyBhIGNyYWZ0ZWQgc2lnbmVkIFVCSUZTIGltYWdl IHJlYWNoZXMgdGhpcyB2aWEKPiB1Ymlmc19yZWFkX3N1cGVyYmxvY2soKSBiZWZvcmUgdGhlIHNp Z25hdHVyZSBpcyBjcnlwdG9ncmFwaGljYWxseSBjaGVja2VkLgo+IAo+IHNub2QtPmxlbiBpcyBn dWFyYW50ZWVkIHRvIGJlID49IFVCSUZTX1NJR19OT0RFX1NaIGJ5IHRoZSBub2RlIHNjYW5uZXIK PiAoYy0+cmFuZ2VzW1VCSUZTX1NJR19OT0RFXS5taW5fbGVuID09IFVCSUZTX1NJR19OT0RFX1Na KSwgc28gdGhlIGNvcnJlY3RlZAo+IHN1YnRyYWN0aW9uIGNhbm5vdCB1bmRlcmZsb3cuIExlZ2l0 aW1hdGVseSBzaWduZWQgaW1hZ2VzIGFyZSB1bmFmZmVjdGVkOiBhCj4gY29ycmVjdCBzdXBlcmJs b2NrIG5ldmVyIGRlY2xhcmVzIGEgc2lnbmF0dXJlIGxvbmdlciB0aGFuIHRoZSBub2RlIGl0IGlz Cj4gZW1iZWRkZWQgaW4uCj4gCj4gRml4ZXM6IDgxN2FhMDk0ODQyZCAoInViaWZzOiBzdXBwb3J0 IG9mZmxpbmUgc2lnbmVkIGltYWdlcyIpCj4gQ2M6IHN0YWJsZUB2Z2VyLmtlcm5lbC5vcmcKPiBT aWduZWQtb2ZmLWJ5OiBJYnJhaGltIEhhc2hpbW92IDxzZWN1cml0eUBhdWRpdGNvZGUuYWk+Cj4g QXNzaXN0ZWQtYnk6IEF1ZGl0Q29kZS1BSToyMDI2LjA3Cj4gLS0tCj4gICBmcy91Ymlmcy9hdXRo LmMgfCAyICstCj4gICAxIGZpbGUgY2hhbmdlZCwgMSBpbnNlcnRpb24oKyksIDEgZGVsZXRpb24o LSkKClJldmlld2VkLWJ5OiBaaGloYW8gQ2hlbmcgPGNoZW5nemhpaGFvMUBodWF3ZWkuY29tPgo+ IAo+IGRpZmYgLS1naXQgYS9mcy91Ymlmcy9hdXRoLmMgYi9mcy91Ymlmcy9hdXRoLmMKPiBpbmRl eCBhNGEwMTU4ZjcxMmQuLjFmNzcwNzk1ZWU3MCAxMDA2NDQKPiAtLS0gYS9mcy91Ymlmcy9hdXRo LmMKPiArKysgYi9mcy91Ymlmcy9hdXRoLmMKPiBAQCAtMjE3LDcgKzIxNyw3IEBAIGludCB1Ymlm c19zYl92ZXJpZnlfc2lnbmF0dXJlKHN0cnVjdCB1Ymlmc19pbmZvICpjLAo+IAo+ICAgCXNpZ25v ZGUgPSBzbm9kLT5ub2RlOwo+IAo+IC0JaWYgKGxlMzJfdG9fY3B1KHNpZ25vZGUtPmxlbikgPiBz bm9kLT5sZW4gKyBzaXplb2Yoc3RydWN0IHViaWZzX3NpZ19ub2RlKSkgewo+ICsJaWYgKGxlMzJf dG9fY3B1KHNpZ25vZGUtPmxlbikgPiBzbm9kLT5sZW4gLSBzaXplb2Yoc3RydWN0IHViaWZzX3Np Z19ub2RlKSkgewo+ICAgCQl1Ymlmc19lcnIoYywgImludmFsaWQgc2lnbmF0dXJlIGxlbiAlZCIs IGxlMzJfdG9fY3B1KHNpZ25vZGUtPmxlbikpOwo+ICAgCQllcnIgPSAtRUlOVkFMOwo+ICAgCQln b3RvIG91dF9kZXN0cm95Owo+IC0tCj4gMi41MC4xIChBcHBsZSBHaXQtMTU1KQo+IC4KPiAKCgpf X19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX19fX18KTGlu dXggTVREIGRpc2N1c3Npb24gbWFpbGluZyBsaXN0Cmh0dHA6Ly9saXN0cy5pbmZyYWRlYWQub3Jn L21haWxtYW4vbGlzdGluZm8vbGludXgtbXRkLwo=