# HG changeset patch
# User charles
# Date 1158271366 -3600
# Node ID 5141f90de139d19c1fcce14345be430c5881f66f
# Parent  c293aabe14d0f8da323298895a320d0e487297ef
Bounds check on ecc correction

diff --git a/yaffs_ecc.c b/yaffs_ecc.c
--- a/yaffs_ecc.c
+++ b/yaffs_ecc.c
@@ -295,7 +295,8 @@ int yaffs_ECCCorrectOther(unsigned char 
 	if ((cDelta | lDelta | lDeltaPrime) == 0)
 		return 0; /* no error */
 
-	if (lDelta == ~lDeltaPrime && (((cDelta ^ (cDelta >> 1)) & 0x15) == 0x15))
+	if (lDelta == ~lDeltaPrime && 
+	    (((cDelta ^ (cDelta >> 1)) & 0x15) == 0x15))
 	{
 		/* Single bit (recoverable) error in data */
 
@@ -308,6 +309,9 @@ int yaffs_ECCCorrectOther(unsigned char 
 		if (cDelta & 0x02)
 			bit |= 0x01;
 
+		if(lDelta >= nBytes)
+			return -1;
+			
 		data[lDelta] ^= (1 << bit);
 
 		return 1; /* corrected */