Hello Daniel, On 15.08.26 17:08, Daniel Golle wrote:
part_get_info_ubi() passes the UBI volume name straight to snprintf() as its format argument:snprintf(info->name, PART_NAME_LEN, vol->name); A volume name that contains a '%' is then interpreted as a printf conversion specifier, yielding a wrong partition name or reading unintended variadic arguments; a '%n' would be undefined behaviour. Volume names are user-defined and boot methods select images by volume name, so copy the name through a "%s" format instead. Fixes: aa5b67ce2262 ("disk: support UBI partitions") Signed-off-by: Daniel Golle <[email protected]> --- drivers/mtd/ubi/part.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Reviewed-by: Heiko Schocher <[email protected]> @tom: I see in patchwork, that it is assigned to you... feel free to pick it up, else I can make a pull request (for master I think as it is a bug fix) if you want, thanks! bye, Heiko -- Nabla Software Engineering HRB 40522 Augsburg Phone: +49 821 45592596 E-Mail: [email protected] Geschäftsführer : Stefano Babic
