From dd62e3af151d4a92aa8251148ec9b88fa558be73 Mon Sep 17 00:00:00 2001 From: Anna Kiri Date: Tue, 26 May 2026 19:10:36 +0200 Subject: [PATCH] mtd: fis: fix buffer overflow from negative memset size In fis_remap(), when desc < last, the memset size is computed as 'tmp - end'. Since tmp is calculated as 'end - positive_value', tmp is always less than end, making 'tmp - end' negative. When cast to size_t, this wraps to a very large value, causing a massive buffer overflow. Fix by swapping the operands to 'end - tmp' which correctly computes the number of bytes to clear. Signed-off-by: Anna Kiri Link: https://github.com/openwrt/openwrt/pull/23550 Signed-off-by: Jonas Jelonek --- package/system/mtd/src/fis.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/package/system/mtd/src/fis.c b/package/system/mtd/src/fis.c index 8f719901b80..936359e8039 100644 --- a/package/system/mtd/src/fis.c +++ b/package/system/mtd/src/fis.c @@ -215,7 +215,7 @@ fis_remap(struct fis_part *old, int n_old, struct fis_part *new, int n_new) memmove(desc, last, end - tmp); if (desc < last) { tmp = end - (last - desc) * sizeof(struct fis_image_desc); - memset(tmp, 0xff, tmp - end); + memset(tmp, 0xff, end - tmp); } } -- 2.47.3