diff options
Diffstat (limited to 'jffsX-utils')
| -rw-r--r-- | jffsX-utils/jffs2dump.c | 9 | ||||
| -rw-r--r-- | jffsX-utils/jffs2reader.c | 3 |
2 files changed, 11 insertions, 1 deletions
diff --git a/jffsX-utils/jffs2dump.c b/jffsX-utils/jffs2dump.c index 30455ea..b757ebe 100644 --- a/jffsX-utils/jffs2dump.c +++ b/jffsX-utils/jffs2dump.c @@ -772,6 +772,13 @@ int main(int argc, char **argv) exit(EXIT_FAILURE); } + if (datsize < 0 || oobsize < 0 || datsize > imglen || (long)datsize + oobsize < 0) { + fprintf(stderr, "Error: invalid datsize/oobsize.\n"); + free(data); + close (fd); + exit(EXIT_FAILURE); + } + if (datsize && oobsize) { int idx = 0; long len = imglen; @@ -783,7 +790,7 @@ int main(int argc, char **argv) read_nocheck (fd, oob, oobsize); idx += datsize; imglen -= oobsize; - len -= datsize + oobsize; + len -= (long)datsize + oobsize; } } else { diff --git a/jffsX-utils/jffs2reader.c b/jffsX-utils/jffs2reader.c index 87a2167..548fc8d 100644 --- a/jffsX-utils/jffs2reader.c +++ b/jffsX-utils/jffs2reader.c @@ -694,6 +694,9 @@ static struct jffs2_raw_dirent *resolvepath0(char *o, size_t size, uint32_t ino, pp = path = xstrdup(p); + if (path == NULL) + return NULL; + if (*path == '/') { path++; ino = 1; |