diff mbox series

[mtd-utils] misc-utils: fix integer overflow in ftl_check.c

Message ID 20241219114900.695819-1-ant.v.moryakov@gmail.com
State Superseded
Delegated to: David Oberhollenzer
Headers show
Series [mtd-utils] misc-utils: fix integer overflow in ftl_check.c | expand

Commit Message

Anton Moryakov Dec. 19, 2024, 11:49 a.m. UTC 
Report of the static analyzer:
An integer overflow may occur due to arithmetic operation (multiplication) between variable 'nbam' and value '4' of 'sizeof(u_int)', when 'nbam' is in range 

Corrections explained:
Avoid arithmetic overflow that could cause an incorrect amount of memory to be allocated.
Handle memory allocation errors (malloc).
The code is robust and safe for large nbam values.

Triggers found by static analyzer Svace.

Signed-off-by: Anton Moryakov <ant.v.moryakov@gmail.com>

---
 misc-utils/ftl_check.c | 9 +++++++++
 1 file changed, 9 insertions(+)
diff mbox series

Patch

diff --git a/misc-utils/ftl_check.c b/misc-utils/ftl_check.c
index 5b2dae5..fe43a24 100644
--- a/misc-utils/ftl_check.c
+++ b/misc-utils/ftl_check.c
@@ -120,8 +120,17 @@  static void check_partition(int fd)
 
 	/* Create basic block allocation table for control blocks */
 	nbam = (mtd.erasesize >> hdr.BlockSize);
+	if (nbam > SIZE_MAX / sizeof(u_int)) {
+		fprintf(stderr, "Error: nbam value too large, potential overflow detected.\n");
+		free(bam);
+		return;
+	}
+
 	bam = malloc(nbam * sizeof(u_int));

+	if (!bam) {
+		perror("malloc failed");
+		return;
+	}
+
 	for (i = 0; i < le16_to_cpu(hdr.NumEraseUnits); i++) {
 		if (lseek(fd, (i << hdr.EraseUnitSize), SEEK_SET) == -1) {
 			perror("seek failed");