diff options
| -rw-r--r-- | target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c | 57 |
1 files changed, 36 insertions, 21 deletions
diff --git a/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c b/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c index ab78037a03..e5257b9212 100644 --- a/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c +++ b/target/linux/generic/files/drivers/platform/mikrotik/rb_hardconfig.c @@ -36,7 +36,7 @@ #include "routerboot.h" -#define RB_HARDCONFIG_VER "0.02" +#define RB_HARDCONFIG_VER "0.03" #define RB_HC_PR_PFX "[rb_hardconfig] " /* ID values for hardware settings */ @@ -483,16 +483,18 @@ static int hc_wlan_data_unpack_lzor(const u8 *inbuf, size_t inlen, void *outbuf, size_t *outlen) { u16 rle_ofs, rle_len; - size_t templen; + const u32 *needle; u8 *tempbuf; + size_t templen, lzo_len; int ret; - templen = inlen + sizeof(hc_lzor_prefix); - if (templen > *outlen) + lzo_len = inlen + sizeof(hc_lzor_prefix); + if (lzo_len > *outlen) return -EFBIG; /* Temporary buffer same size as the outbuf */ - tempbuf = kmalloc(*outlen, GFP_KERNEL); + templen = *outlen; + tempbuf = kmalloc(templen, GFP_KERNEL); if (!outbuf) return -ENOMEM; @@ -500,41 +502,54 @@ static int hc_wlan_data_unpack_lzor(const u8 *inbuf, size_t inlen, memcpy(outbuf, hc_lzor_prefix, sizeof(hc_lzor_prefix)); memcpy(outbuf + sizeof(hc_lzor_prefix), inbuf, inlen); - /* LZO-decompress templen bytes of outbuf into the tempbuf */ - ret = lzo1x_decompress_safe(outbuf, templen, tempbuf, outlen); + /* LZO-decompress lzo_len bytes of outbuf into the tempbuf */ + ret = lzo1x_decompress_safe(outbuf, lzo_len, tempbuf, &templen); if (ret) { - pr_debug(RB_HC_PR_PFX "LZO decompression error (%d)\n", ret); - goto fail; + if (LZO_E_INPUT_NOT_CONSUMED == ret) { + /* + * It is assumed that because the LZO payload is embedded + * in a "root" RB_ID_WLAN_DATA tag, the tag length is aligned + * and the payload is padded at the end, which triggers a + * spurious error which we ignore here. + */ + pr_debug(RB_HC_PR_PFX "LZOR: LZO EOF before buffer end - this may be harmless\n"); + } else { + pr_debug(RB_HC_PR_PFX "LZOR: LZO decompression error (%d)\n", ret); + goto fail; + } } - templen = *outlen; /* * Post decompression we have a blob (possibly byproduct of the lzo * dictionary). We need to find RB_MAGIC_ERD. The magic number seems to * be 32bit-aligned in the decompression output. */ - - while (RB_MAGIC_ERD != *(u32 *)tempbuf) { - tempbuf += 4; - templen -= 4; - } + needle = (const u32 *)tempbuf; + while (RB_MAGIC_ERD != *needle++) { + if ((u8 *)needle >= tempbuf+templen) { + pr_debug(RB_HC_PR_PFX "LZOR: ERD magic not found\n"); + goto fail; + } + }; + templen -= (u8 *)needle - tempbuf; /* Past magic. Look for tag node */ - ret = routerboot_tag_find(tempbuf, templen, 0x1, &rle_ofs, &rle_len); + ret = routerboot_tag_find((u8 *)needle, templen, 0x1, &rle_ofs, &rle_len); if (ret) { - pr_debug(RB_HC_PR_PFX "RLE data not found\n"); + pr_debug(RB_HC_PR_PFX "LZOR: RLE data not found\n"); goto fail; } if (rle_len > templen) { - pr_debug(RB_HC_PR_PFX "Invalid RLE data length\n"); + pr_debug(RB_HC_PR_PFX "LZOR: Invalid RLE data length\n"); + ret = -EINVAL; goto fail; } - /* RLE-decode tempbuf back into the outbuf */ - ret = routerboot_rle_decode(tempbuf+rle_ofs, rle_len, outbuf, outlen); + /* RLE-decode tempbuf from needle back into the outbuf */ + ret = routerboot_rle_decode((u8 *)needle+rle_ofs, rle_len, outbuf, outlen); if (ret) - pr_debug(RB_HC_PR_PFX "RLE decoding error (%d)\n", ret); + pr_debug(RB_HC_PR_PFX "LZOR: RLE decoding error (%d)\n", ret); fail: kfree(tempbuf); |