ubi-utils: fix memory corruptions

This patch contains changes similar to the ones in the previous
patch.

Also, it changes all invocations of memset and makes sure
the argument is 0, not '\0', because memset expects int,
not char.

Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>

1 files changed, 12 insertions, 5 deletions

diff --git a/ubi-utils/src/libubi.c b/ubi-utils/src/libubi.c
index 6f9228e..a4313ab 100644
--- a/ubi-utils/src/libubi.c
+++ b/ubi-utils/src/libubi.c
@@ -166,6 +166,13 @@ static int read_data(const char *file, void *buf, int buf_len)
 		sys_errmsg("cannot read \"%s\"", file);
 		goto out_error;
 	}
+
+	if (rd == buf_len) {
+		errmsg("contents of \"%s\" is too long", file);
+		errno = EINVAL;
+		goto out_error;
+	}
+
 	((char *)buf)[rd] = '\0';
 
 	/* Make sure all data is read */
@@ -676,7 +683,7 @@ int ubi_attach_mtd(libubi_t desc, const char *node,
 	int fd, ret;
 	struct ubi_attach_req r;
 
-	memset(&r, sizeof(struct ubi_attach_req), '\0');
+	memset(&r, 0, sizeof(struct ubi_attach_req));
 
 	desc = desc;
 	r.ubi_num = req->dev_num;
@@ -806,7 +813,7 @@ int ubi_get_info(libubi_t desc, struct ubi_info *info)
 	struct dirent *dirent;
 	struct libubi *lib = (struct libubi *)desc;
 
-	memset(info, '\0', sizeof(struct ubi_info));
+	memset(info, 0, sizeof(struct ubi_info));
 
 	if (read_major(lib->ctrl_dev, &info->ctrl_major, &info->ctrl_minor)) {
 		/*
@@ -881,7 +888,7 @@ int ubi_mkvol(libubi_t desc, const char *node, struct ubi_mkvol_request *req)
 	struct ubi_mkvol_req r;
 	size_t n;
 
-	memset(&r, sizeof(struct ubi_mkvol_req), '\0');
+	memset(&r, 0, sizeof(struct ubi_mkvol_req));
 
 	desc = desc;
 	r.vol_id = req->vol_id;
@@ -1034,7 +1041,7 @@ int ubi_get_dev_info1(libubi_t desc, int dev_num, struct ubi_dev_info *info)
 	struct dirent *dirent;
 	struct libubi *lib = (struct libubi *)desc;
 
-	memset(info, '\0', sizeof(struct ubi_dev_info));
+	memset(info, 0, sizeof(struct ubi_dev_info));
 	info->dev_num = dev_num;
 
 	if (!dev_present(lib, dev_num))
@@ -1137,7 +1144,7 @@ int ubi_get_vol_info1(libubi_t desc, int dev_num, int vol_id,
 	struct libubi *lib = (struct libubi *)desc;
 	char buf[50];
 
-	memset(info, '\0', sizeof(struct ubi_vol_info));
+	memset(info, 0, sizeof(struct ubi_vol_info));
 	info->dev_num = dev_num;
 	info->vol_id = vol_id;