mtd mtdsplit-fit: fix potential out of bounds read

Account the offset_start in the bounds check of the for loop. This was
previously missing, differing in check and actual read.

Signed-off-by: David Bauer <mail@david-bauer.net>

diff --git a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c
index 276e9fc9e1ebcf9038ae4076414ea96bfe83a969..97d86ab51fb3f477df7013f1884fce65bce80ac3 100644 (file)
--- a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c
+++ b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c
@@ -218,7 +218,7 @@ mtdsplit_fit_parse(struct mtd_info *mtd,
        hdr_len = sizeof(struct fdt_header);
 
        /* Parse the MTD device & search for the FIT image location */
-       for(offset = 0; offset + hdr_len <= mtd->size; offset += mtd->erasesize) {
+       for (offset = 0; offset + offset_start + hdr_len <= mtd->size; offset += mtd->erasesize) {
                ret = mtd_read(mtd, offset + offset_start, hdr_len, &retlen, (void*) &hdr);
                if (ret) {
                        pr_err("read error in \"%s\" at offset 0x%llx\n",