diff options
| -rw-r--r-- | target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_uimage.c | 20 |
1 files changed, 7 insertions, 13 deletions
diff --git a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_uimage.c b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_uimage.c index 3ddb71bfa7..26cb66ac7f 100644 --- a/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_uimage.c +++ b/target/linux/generic/files/drivers/mtd/mtdsplit/mtdsplit_uimage.c @@ -310,27 +310,21 @@ static struct mtd_part_parser uimage_netgear_parser = { static ssize_t uimage_find_edimax(u_char *buf, size_t len) { - struct uimage_header *header; + u32 *magic; - if (len < FW_EDIMAX_OFFSET + sizeof(*header)) { + if (len < FW_EDIMAX_OFFSET + sizeof(struct uimage_header)) { pr_err("Buffer too small for checking Edimax header\n"); return -ENOSPC; } - header = (struct uimage_header *)(buf + FW_EDIMAX_OFFSET); - - switch be32_to_cpu(header->ih_magic) { - case FW_MAGIC_EDIMAX: - break; - default: + magic = (u32 *)buf; + if (be32_to_cpu(*magic) != FW_MAGIC_EDIMAX) return -EINVAL; - } - if (header->ih_os != IH_OS_LINUX || - header->ih_type != IH_TYPE_FILESYSTEM) - return -EINVAL; + if (!uimage_verify_default(buf + FW_EDIMAX_OFFSET, len)) + return FW_EDIMAX_OFFSET; - return FW_EDIMAX_OFFSET; + return -EINVAL; } static int |