leandrof/u-boot
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

fs: cbfs: Fix out of bound access during CBFS walking through

Browse Source 
The call to file_cbfs_fill_cache() is given with the parameter
'start' pointing to the offset by the CBFS base address, but
with the parameter 'size' that equals to the whole CBFS size.
During CBFS walking through, it checks files one by one and
after it pass over the end of the CBFS which is 4GiB boundary
it tries to check files from address 0 and so on, until the
overall size the codes checked hits to the given 'size'.

Fix this by passing 'start' pointing to the CBFS base address.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
This commit is contained in:
Bin Meng 2018-12-22 01:55:49 -08:00
parent 9914c73261
commit d94bf13c85
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
fs/cbfs/cbfs.c
View File

@ -189,8 +189,8 @@ void file_cbfs_init(uintptr_t end_of_rom)
start_of_rom = (u8 *)(end_of_rom + 1 - cbfs_header.rom_size);
file_cbfs_fill_cache(start_of_rom + cbfs_header.offset,
cbfs_header.rom_size, cbfs_header.align);
file_cbfs_fill_cache(start_of_rom, cbfs_header.rom_size,
cbfs_header.align);
if (file_cbfs_result == CBFS_SUCCESS)
initialized = 1;
}