This patch is to prevent the call to aw_fel_write_uboot_image() with
insufficient file size. If a user passes a boot file smaller than 32K,
e.g. on "fel spl sunxi-spl.bin", the expression (size - SPL_LEN_LIMIT)
would end up negative, and causes a numeric underflow when passed to
aw_fel_write_uboot_image() as "size_t len". This might incorrectly let
that function assume a u-boot binary was passed, when actually it
isn't supposed to act on the buffer at all.
Signed-off-by: Bernhard Nortmann <bernhard.nortm...@web.de>
---
fel.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/fel.c b/fel.c
index 41b19c9..a5cb99d 100644
--- a/fel.c
+++ b/fel.c
@@ -815,7 +815,8 @@ void aw_fel_process_spl_and_uboot(libusb_device_handle *usb,
/* write and execute the SPL from the buffer */
aw_fel_write_and_execute_spl(usb, buf, size);
/* check for optional main U-Boot binary (and transfer it, if
applicable) */
- aw_fel_write_uboot_image(usb, buf + SPL_LEN_LIMIT, size -
SPL_LEN_LIMIT);
+ if (size > SPL_LEN_LIMIT)
+ aw_fel_write_uboot_image(usb, buf + SPL_LEN_LIMIT, size -
SPL_LEN_LIMIT);
}
static int aw_fel_get_endpoint(libusb_device_handle *usb)
--
2.4.6
--
You received this message because you are subscribed to the Google Groups
"linux-sunxi" group.
To unsubscribe from this group and stop receiving emails from it, send an email
to linux-sunxi+unsubscr...@googlegroups.com.
For more options, visit https://groups.google.com/d/optout.
