From: Jianan Huang <jnhuang95@gmail.com>
Date: Wed, 5 Jun 2024 14:05:54 +0000 (+0000)
Subject: fs/erofs: fix an overflow issue of unmapped extents
X-Git-Url: http://git.dujemihanovic.xyz/?a=commitdiff_plain;h=2c9690e79c76807468e34f34d2065ade2d727227;p=u-boot.git

fs/erofs: fix an overflow issue of unmapped extents

Here the size should be `length - skip`, otherwise it could cause
the destination buffer overflow.

Reported-by: jianqiang wang <wjq.sec@gmail.com>
Fixes: 65cb73057b65 ("fs/erofs: add lz4 decompression support")
Signed-off-by: Jianan Huang <jnhuang95@gmail.com>
Reviewed-by: Gao Xiang <hsiangkao@linux.alibaba.com>
---

diff --git a/fs/erofs/data.c b/fs/erofs/data.c
index f4b21d7917..95b609d8ea 100644
--- a/fs/erofs/data.c
+++ b/fs/erofs/data.c
@@ -313,7 +313,7 @@ static int z_erofs_read_data(struct erofs_inode *inode, char *buffer,
 		}
 
 		if (!(map.m_flags & EROFS_MAP_MAPPED)) {
-			memset(buffer + end - offset, 0, length);
+			memset(buffer + end - offset, 0, length - skip);
 			end = map.m_la;
 			continue;
 		}