mirror of
https://git.openwrt.org/openwrt/openwrt.git
synced 2026-09-09 00:06:08 +08:00
Anna Kiri
dd62e3af15
In fis_remap(), when desc < last, the memset size is computed as 'tmp - end'. Since tmp is calculated as 'end - positive_value', tmp is always less than end, making 'tmp - end' negative. When cast to size_t, this wraps to a very large value, causing a massive buffer overflow. Fix by swapping the operands to 'end - tmp' which correctly computes the number of bytes to clear. Signed-off-by: Anna Kiri <bredcorn@gmail.com> Link: https://github.com/openwrt/openwrt/pull/23550 Signed-off-by: Jonas Jelonek <jelonek.jonas@gmail.com>