| commit | 68f82b089b6c2caffb9865657c7893ca33d4a7cf | [log] [tgz] |
|---|---|---|
| author | Daniel Mentz <danielmentz@google.com> | Thu Aug 28 15:47:33 2014 -0700 |
| committer | Daniel Mentz <danielmentz@google.com> | Fri Jan 09 15:38:34 2015 -0800 |
| tree | e4ee5da694f3ac75c1c9e0fdb65c6afd79f58793 | |
| parent | be65ca0ec709e6439f35a759ccc89e4365a9e0ad [diff] |
Bounds check length of ubifs data node for hexdump Due to corrupt ubifs meta data and a missing bounds check dbg_dump_node() tried to dump a data buffer of length -1. The value -1 got coerced into a size_t. Since size_t is unsigned, print_hex_dump() attempted to dump 0xFFFFFFFF bytes of data and eventually caused a page fault. Change-Id: I9d1fc1027d3c2118c0796f214c34ce93e8915a25