From: David Bauer Date: Wed, 22 Jul 2026 23:03:07 +0000 (+0200) Subject: mtd mtdsplit-fit: fix potential out of bounds read X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=HEAD;p=thirdparty%2Fopenwrt.git mtd mtdsplit-fit: fix potential out of bounds read Account the offset_start in the bounds check of the for loop. This was previously missing, differing in check and actual read. Signed-off-by: David Bauer --- diff --git a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c index 276e9fc9e1e..97d86ab51fb 100644 --- a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c +++ b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_fit.c @@ -218,7 +218,7 @@ mtdsplit_fit_parse(struct mtd_info *mtd, hdr_len = sizeof(struct fdt_header); /* Parse the MTD device & search for the FIT image location */ - for(offset = 0; offset + hdr_len <= mtd->size; offset += mtd->erasesize) { + for (offset = 0; offset + offset_start + hdr_len <= mtd->size; offset += mtd->erasesize) { ret = mtd_read(mtd, offset + offset_start, hdr_len, &retlen, (void*) &hdr); if (ret) { pr_err("read error in \"%s\" at offset 0x%llx\n",