Mirrors/u-boot
2
0
Fork 0
mirror of https://github.com/AsahiLinux/u-boot synced 2024-11-10 23:24:38 +00:00
Code Issues Projects Releases Packages Wiki Activity

dfu: dfu_get_buf: check the value of env dfu_bufsiz before use

Browse source 
In function dfu_get_buf(), the size of allocated buffer could
be defined by the env variable. The size from this variable
was passed for memalign() without checking its value.
And the the memalign will return non null pointer for size 0.

This could possibly cause data abort, so now the value of var
is checked before use. And if this variable is set to 0 then
the default size will be used.

This commit also changes the base passed to simple_strtoul()
to 0. Now decimal and hex values can be used for the variable
dfu_bufsiz.

Signed-off-by: Przemyslaw Marczak <p.marczak@samsung.com>
Tested-by: Lukasz Majewski <l.majewski@samsung.com>
[TestHW: Exynos4412-Trats2]
This commit is contained in:
Przemyslaw Marczak 2014-12-15 10:34:11 +01:00 committed by Lukasz Majewski
parent 62a96d805f
commit f597fc3d4c
1 changed files with 6 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

8
drivers/dfu/dfu.c
View file

@ -95,8 +95,12 @@ unsigned char *dfu_get_buf(struct dfu_entity *dfu)
return dfu_buf;
s = getenv("dfu_bufsiz");
dfu_buf_size = s ? (unsigned long)simple_strtol(s, NULL, 16) :
CONFIG_SYS_DFU_DATA_BUF_SIZE;
if (s)
dfu_buf_size = (unsigned long)simple_strtol(s, NULL, 0);
if (!s || !dfu_buf_size)
dfu_buf_size = CONFIG_SYS_DFU_DATA_BUF_SIZE;
if (dfu->max_buf_size && dfu_buf_size > dfu->max_buf_size)
dfu_buf_size = dfu->max_buf_size;