leandrof/u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

net: tftp: Fix tftp store address check in store_block()

Browse Source 
During testing of qemu-riscv32 with a 2GiB memory configuration,
tftp always fails with a error message:

  Load address: 0x84000000
  Loading: #
  TFTP error: trying to overwrite reserved memory...

It turns out the result of 'tftp_load_addr + tftp_load_size' just
overflows (0x100000000) and the test logic in store_block() fails.
Fix this by adjusting the end address to ULONG_MAX when overflow
is detected.

Fixes: a156c47e39 ("tftp: prevent overwriting reserved memory")
Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Acked-by: Joe Hershberger <joe.hershberger@ni.com>
This commit is contained in:
Bin Meng 2019-11-15 22:20:13 -08:00 committed by Joe Hershberger
parent 8524423da9
commit ca48cb4028
1 changed files with 6 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
net/tftp.c
View File

@ -171,8 +171,13 @@ static inline int store_block(int block, uchar *src, unsigned int len)
void *ptr;
#ifdef CONFIG_LMB
ulong end_addr = tftp_load_addr + tftp_load_size;
if (!end_addr)
end_addr = ULONG_MAX;
if (store_addr < tftp_load_addr ||
store_addr + len > tftp_load_addr + tftp_load_size) {
store_addr + len > end_addr) {
puts("\nTFTP error: ");
puts("trying to overwrite reserved memory...\n");
return -1;