From: Richard Genoud <richard.genoud@posteo.net>
Date: Tue, 3 Nov 2020 11:11:23 +0000 (+0100)
Subject: fs/squashfs: sqfs_read: don't write beyond buffer size
X-Git-Url: http://git.dujemihanovic.xyz/?a=commitdiff_plain;h=cbd5e40ede4e5c6aedce9475325bdf80b7fa839b;p=u-boot.git

fs/squashfs: sqfs_read: don't write beyond buffer size

The length of the buffer wasn't taken into account when writing to the
given buffer.

Signed-off-by: Richard Genoud <richard.genoud@posteo.net>
---

diff --git a/fs/squashfs/sqfs.c b/fs/squashfs/sqfs.c
index 435081638b..1ecdd01cf7 100644
--- a/fs/squashfs/sqfs.c
+++ b/fs/squashfs/sqfs.c
@@ -1415,6 +1415,8 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
 		}
 
 		finfo.size = len;
+	} else {
+		len = finfo.size;
 	}
 
 	if (datablk_count) {
@@ -1461,9 +1463,13 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
 			if (ret)
 				goto out;
 
+			if ((*actread + dest_len) > len)
+				dest_len = len - *actread;
 			memcpy(buf + offset + *actread, datablock, dest_len);
 			*actread += dest_len;
 		} else {
+			if ((*actread + table_size) > len)
+				table_size = len - *actread;
 			memcpy(buf + offset + *actread, data, table_size);
 			*actread += table_size;
 		}
@@ -1471,6 +1477,8 @@ int sqfs_read(const char *filename, void *buf, loff_t offset, loff_t len,
 		data_offset += table_size;
 		free(data_buffer);
 		data_buffer = NULL;
+		if (*actread >= len)
+			break;
 	}
 
 	/*