lib/mpi: Fix buffer overrun when SG is too long

[platform/kernel/linux-starfive.git] / lib / mpi / mpicoder.c

diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
index 39c4c67..3cb6bd1 100644 (file)
--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -504,7 +504,8 @@ MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int nbytes)
 
        while (sg_miter_next(&miter)) {
                buff = miter.addr;
-               len = miter.length;
+               len = min_t(unsigned, miter.length, nbytes);
+               nbytes -= len;
 
                for (x = 0; x < len; x++) {
                        a <<= 8;