From: Rafał Miłecki <zajec5@gmail.com>
Date: Tue, 7 Jul 2015 21:21:49 +0000 (+0000)
Subject: nvram: fix "Segmentation fault" caused by setting memory out of buffer
X-Git-Tag: reboot~2563
X-Git-Url: http://git.lede-project.org./?a=commitdiff_plain;h=9f158499108eae39555bc65d1abfd86bd0c65533;p=openwrt%2Fstaging%2Fjogo.git

nvram: fix "Segmentation fault" caused by setting memory out of buffer

Some MTD partitions with NVRAM have content starting in the middle. In
such case offset is set and nvram_header returns pointer to the middle.
It means we have to respect offset when calculating remaining space.

By the way use real MTD partition size (nvram_part_size variable) as we
may want to bump NVRAM_SPACE in the (very near) future.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>

SVN-Revision: 46251
---

diff --git a/package/utils/nvram/src/nvram.c b/package/utils/nvram/src/nvram.c
index c4bcb1d4a6..c490597d4b 100644
--- a/package/utils/nvram/src/nvram.c
+++ b/package/utils/nvram/src/nvram.c
@@ -286,11 +286,11 @@ int nvram_commit(nvram_handle_t *h)
 
 	/* Clear data area */
 	ptr = (char *) header + sizeof(nvram_header_t);
-	memset(ptr, 0xFF, NVRAM_SPACE - sizeof(nvram_header_t));
+	memset(ptr, 0xFF, nvram_part_size - h->offset - sizeof(nvram_header_t));
 	memset(&tmp, 0, sizeof(nvram_header_t));
 
 	/* Leave space for a double NUL at the end */
-	end = (char *) header + NVRAM_SPACE - 2;
+	end = (char *) header + nvram_part_size - h->offset - 2;
 
 	/* Write out all tuples */
 	for (i = 0; i < NVRAM_ARRAYSIZE(h->nvram_hash); i++) {