On 8/18/26 15:07, Patrice Chotard wrote:
read_metadata() allocates a single buffer holding both metadata copies (calloc(2, mdata_size)) but accesses each copy through &mdata[id], where mdata is a "struct fwu_mdata *". That stride is sizeof(struct fwu_mdata), i.e. the 16-byte common header only, not mdata_size, so reading the second copy overwrites the body of the first and the two copies overlap. When both copies are identical the overlap is harmless, but as soon as they differ (e.g. after an interrupted update, the exact case the tool is meant to recover) the primary is corrupted: for V2 the metadata_size check then reads garbage and the tool aborts with a bogus size mismatch, for V1 it silently operates on a mixed view and can write it back to both copies. Index the copies by byte offset (mdata_size) through a small mdata_copy() helper instead of struct-typed pointer arithmetic. Both copies are guaranteed to share the same size (checked in parse_config()).
Reviewed-by: Kory Maincent <[email protected]> Thank you! -- Köry Maincent, Bootlin Embedded Linux and kernel engineering https://bootlin.com
