The current implementation casts an address to a pointer. Make it more sandbox-friendly by using map_sysmem().
Convert 'addr' variable to unsigned long, as that is the return type of hextoul() and address parameter type of map_sysmem(). Signed-off-by: Marek Vasut <[email protected]> --- Cc: Alexander Graf <[email protected]> Cc: Heinrich Schuchardt <[email protected]> Cc: Ilias Apalodimas <[email protected]> Cc: Jerome Forissier <[email protected]> Cc: Mattijs Korpershoek <[email protected]> Cc: Neil Armstrong <[email protected]> Cc: Peng Fan <[email protected]> Cc: Quentin Schulz <[email protected]> Cc: Simon Glass <[email protected]> Cc: Tom Rini <[email protected]> Cc: Yuya Hamamachi <[email protected]> Cc: [email protected] --- V2: Add missing unmap_sysmem() --- cmd/unzip.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/cmd/unzip.c b/cmd/unzip.c index da958f12803..ba83995040b 100644 --- a/cmd/unzip.c +++ b/cmd/unzip.c @@ -50,11 +50,12 @@ static int do_gzwrite(struct cmd_tbl *cmdtp, int flag, { struct blk_desc *bdev; int ret; - unsigned char *addr; + unsigned long addr; unsigned long length; unsigned long writebuf = 1<<20; off_t startoffs = 0; size_t szexpected = 0; + void *addrp; if (argc < 5) return CMD_RET_USAGE; @@ -62,7 +63,7 @@ static int do_gzwrite(struct cmd_tbl *cmdtp, int flag, if (ret < 0) return CMD_RET_FAILURE; - addr = (unsigned char *)hextoul(argv[3], NULL); + addr = hextoul(argv[3], NULL); length = hextoul(argv[4], NULL); if (5 < argc) { @@ -75,7 +76,11 @@ static int do_gzwrite(struct cmd_tbl *cmdtp, int flag, } } - ret = gzwrite(addr, length, bdev, writebuf, startoffs, szexpected); + addrp = map_sysmem(addr, length); + + ret = gzwrite(addrp, length, bdev, writebuf, startoffs, szexpected); + + unmap_sysmem(addrp); return ret ? CMD_RET_FAILURE : CMD_RET_SUCCESS; } -- 2.51.0
