ppc: ppmc7xx: Fix possible out-of-bound access
PATCH 1/1 ppc: ppmc7xx: Fix possible out-of-bound access
The flash_info_t->start[] field is limited in size by CONFIG_SYS_MAX_FLASH_SECT macro, which is set to 19 for this board in the board config file. If we inspect the board/ppmc7xx/flash.c closely, especially the flash_get_size() function, we can notice the "switch ((long)flashtest)" at around line 80 having a few results which will set flash_info_t->sector_count to value higher than 19, for example "case AMD_ID_LV640U" will set it to 128. Notice that right underneath, iteration over flash_info_t->start[] happens and the upper bound for the interation is flash_info_t->sector_count. Now if the sector_count is 128 as it is for the AMD_ID_LV640U case, but the CONFIG_SYS_MAX_FLASH_SECT limiting the start[] is only 19, an access past the start[] array much happen. Moreover, during this iteration, the field is written to, so memory corruption is inevitable.
--- include/configs/ppmc7xx.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/configs/ppmc7xx.h +1 -1
@@ -233,7 +233,7 @@#define CONFIG_SYS_FLASH_ERASE_TOUT 250000#define CONFIG_SYS_FLASH_WRITE_TOUT 5000#define CONFIG_SYS_MAX_FLASH_BANKS 1 -#define CONFIG_SYS_MAX_FLASH_SECT 19 +#define CONFIG_SYS_MAX_FLASH_SECT 128/*
Signature · 1 line
1.7.10.4
Wolfgang Denk
AppliedPATCH 1/1 ppc: ppmc7xx: Fix possible out-of-bound access
Dear Marek Vasut,
Quoted 12 lines · In message <[email protected]> you wrote:
The flash_info_t->start[] field is limited in size by
CONFIG_SYS_MAX_FLASH_SECTmacro, which is set to 19 for this board in the board config file. If we inspect theboard/ppmc7xx/flash.cclosely, especially theflash_get_size()function, we can notice the "switch ((long)flashtest)" at around line 80 having a few results which will setflash_info_t->sector_countto value higher than 19, for example "caseAMD_ID_LV640U" will set it to 128. Notice that right underneath, iteration over flash_info_t->start[] happens and the upper bound for the interation isflash_info_t->sector_count. Now if thesector_countis 128 as it is for theAMD_ID_LV640Ucase, but theCONFIG_SYS_MAX_FLASH_SECTlimiting the start[] is only 19, an access past the start[] array much happen. Moreover, during this iteration, the field is written to, so memory corruption is inevitable.
Quoted 7 lines
Signed-off-by Marek Vasut <[email protected]>Cc Wolfgang Denk <[email protected]>Cc Tom Rini <[email protected]>Cc Richard Danter <[email protected]>--- include/configs/ppmc7xx.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
Applied, thanks.
Best regards,
Wolfgang Denk
Signature · 7 lines
DENX Software Engineering GmbH, MD: Wolfgang Denk & Detlev Zundel
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: (+49)-8142-66989-10 Fax: (+49)-8142-66989-80 Email: wd at denx.de
You could end up being oddly sad and full of a strange, diffuse com-
passion which would lead you to believe that it might be a good idea
to wipe out the whole human race and start again with amoebas.
- Terry Pratchett, _Guards! Guards!_