--- fs/partitions/ldm.c

+++ fs/partitions/ldm.c

@@ -1299,6 +1299,11 @@ static bool ldm_frag_add (const u8 *data

BUG_ON (!data || !frags);

+ if (size < 2 * VBLK_SIZE_HEAD) {

+ ldm_error("Value of size is to small.");

+ return false;

+ }

+

group = get_unaligned_be32(data + 0x08);

rec = get_unaligned_be16(data + 0x0C);

num = get_unaligned_be16(data + 0x0E);

@@ -1306,6 +1311,10 @@ static bool ldm_frag_add (const u8 *data

ldm_error ("A VBLK claims to have %d parts.", num);

return false;

}

+ if (rec >= num) {

+ ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);

+ return false;

+ }

list_for_each (item, frags) {

f = list_entry (item, struct frag, list);

@@ -1334,10 +1343,9 @@ found:

f->map |= (1 << rec);

- if (num > 0) {

- data += VBLK_SIZE_HEAD;

- size -= VBLK_SIZE_HEAD;

- }

+ data += VBLK_SIZE_HEAD;

+ size -= VBLK_SIZE_HEAD;

+

memcpy (f->data+rec*(size-VBLK_SIZE_HEAD)+VBLK_SIZE_HEAD, data, size);

return true;