imximage: header.length of 4 is valid

PATCH New Troy Kisky 2 participants 6 messages Sep 21, 2015 – Oct 7, 2015 Arm i.MX and Layerscape

lore

Share & tools

lore

Troy Kisky

author

2015-09-21 21:02 UTC #0 lore raw

PATCH 1/1 imximage: header.length of 4 is valid

Signed-off-by Troy Kisky <[email protected]>

---
 tools/imximage.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

tools/imximage.c +2 -2

index 97a6880..7c21922 100644
@@ -396,8 +396,8 @@ static void print_hdr_v2(struct imx_header *imx_hdr)
 	dcd_v2_t *dcd_v2 = &hdr_v2->dcd_table;
 	uint32_t size, version;
 
-	size = be16_to_cpu(dcd_v2->header.length) - 8;
-	if (size > (MAX_HW_CFG_SIZE_V2 * sizeof(dcd_addr_data_t))) {
+	size = be16_to_cpu(dcd_v2->header.length);
+	if (size > (MAX_HW_CFG_SIZE_V2 * sizeof(dcd_addr_data_t)) + 8) {
 		fprintf(stderr,
 			"Error: Image corrupt DCD size %d exceed maximum %d\n",
 			(uint32_t)(size / sizeof(dcd_addr_data_t)),

Signature · 1 line

1.9.1

Troy Kisky

author

2015-10-05 23:17 UTC #1 lore raw

PATCH 1/1 imximage: header.length of 4 is valid

Quoted 11 lines · Troy Kisky

Signed-off-by Troy Kisky <[email protected]>
---
 tools/imximage.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
tools/imximage.c +0 -0
index 97a6880..7c21922 100644

tools/imximage.c static void print_hdr_v2(struct imx_header *imx_hdr) · line 403

Quoted 10 lines

tools/imximage.c +2 -2

@@ -396,8 +396,8 @@ static void print_hdr_v2(struct imx_header *imx_hdr)
 	dcd_v2_t *dcd_v2 = &hdr_v2->dcd_table;
 	uint32_t size, version;
 
-	size = be16_to_cpu(dcd_v2->header.length) - 8;
-	if (size > (MAX_HW_CFG_SIZE_V2 * sizeof(dcd_addr_data_t))) {
+	size = be16_to_cpu(dcd_v2->header.length);
+	if (size > (MAX_HW_CFG_SIZE_V2 * sizeof(dcd_addr_data_t)) + 8) {
 		fprintf(stderr,
 			"Error: Image corrupt DCD size %d exceed maximum %d\n",
 			(uint32_t)(size / sizeof(dcd_addr_data_t)),

Hi Stefano,

Are there outstanding concerns about applying this patch and then applying

imximage: fix commands other than write_data

Where you replied
"This patch breaks building boards with SPL:

Building current source for 85 boards (6 threads, 1 job per thread)
arm: + colibri_vf_dtb
+Error: Image corrupt DCD size 536870911 exceed maximum 220 +make[2]: *** [u-boot-dtb.imx] Error 1
+make[1]: *** [u-boot-dtb.imx] Error 2
+make: *** [sub-make] Error 2
arm: + mx6sabresd_spl
+Error: Image corrupt DCD size 536870911 exceed maximum 220 "

Or would you rather that I squash them together?

Thanks
Troy

stefano babic

2015-10-06 11:30 UTC #2 lore raw

PATCH 1/1 imximage: header.length of 4 is valid

Hi Troy,

Am 06.10.2015 um 00:17 schrieb Troy Kisky:

Quoted 44 lines · Troy Kisky

Quoted 11 lines
Signed-off-by Troy Kisky <[email protected]>
---
 tools/imximage.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
tools/imximage.c +0 -0
index 97a6880..7c21922 100644
tools/imximage.c static void print_hdr_v2(struct imx_header *imx_hdr) · line 403
Quoted 10 lines
tools/imximage.c +2 -2
@@ -396,8 +396,8 @@ static void print_hdr_v2(struct imx_header *imx_hdr)
 	dcd_v2_t *dcd_v2 = &hdr_v2->dcd_table;
 	uint32_t size, version;
 
-	size = be16_to_cpu(dcd_v2->header.length) - 8;
-	if (size > (MAX_HW_CFG_SIZE_V2 * sizeof(dcd_addr_data_t))) {
+	size = be16_to_cpu(dcd_v2->header.length);
+	if (size > (MAX_HW_CFG_SIZE_V2 * sizeof(dcd_addr_data_t)) + 8) {
 		fprintf(stderr,
 			"Error: Image corrupt DCD size %d exceed maximum %d\n",
 			(uint32_t)(size / sizeof(dcd_addr_data_t)),
Hi Stefano,
Are there outstanding concerns about applying this patch and then applying
imximage: fix commands other than write_data
Where you replied
"This patch breaks building boards with SPL:
Building current source for 85 boards (6 threads, 1 job per thread)
arm: + colibri_vf_dtb
(quoted diff) +5 -0
+Error: Image corrupt DCD size 536870911 exceed maximum 220
+make[2]: *** [u-boot-dtb.imx] Error 1
+make[1]: *** [u-boot-dtb.imx] Error 2
+make: *** [sub-make] Error 2
       arm:  +   mx6sabresd_spl
+Error: Image corrupt DCD size 536870911 exceed maximum 220
"

Quoted 1 line

Or would you rather that I squash them together?

Yes, please do it - I would like to avoid issues by git bisect.

Thanks,
Stefano

Signature · 5 lines

=====================================================================
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: +49-8142-66989-53 Fax: +49-8142-66989-80 Email: sbabic at denx.de
=====================================================================

Troy Kisky

author

2015-10-06 18:09 UTC #3 lore raw

PATCH 1/1 imximage: header.length of 4 is valid

Quoted 47 lines · stefano babic

Hi Troy,
Am 06.10.2015 um 00:17 schrieb Troy Kisky:
Quoted 44 lines · Troy Kisky
Quoted 11 lines
Signed-off-by Troy Kisky <[email protected]>
---
 tools/imximage.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
tools/imximage.c +0 -0
index 97a6880..7c21922 100644
tools/imximage.c static void print_hdr_v2(struct imx_header *imx_hdr) · line 403
Quoted 10 lines
tools/imximage.c +2 -2
@@ -396,8 +396,8 @@ static void print_hdr_v2(struct imx_header *imx_hdr)
 	dcd_v2_t *dcd_v2 = &hdr_v2->dcd_table;
 	uint32_t size, version;
 
-	size = be16_to_cpu(dcd_v2->header.length) - 8;
-	if (size > (MAX_HW_CFG_SIZE_V2 * sizeof(dcd_addr_data_t))) {
+	size = be16_to_cpu(dcd_v2->header.length);
+	if (size > (MAX_HW_CFG_SIZE_V2 * sizeof(dcd_addr_data_t)) + 8) {
 		fprintf(stderr,
 			"Error: Image corrupt DCD size %d exceed maximum %d\n",
 			(uint32_t)(size / sizeof(dcd_addr_data_t)),
Hi Stefano,
Are there outstanding concerns about applying this patch and then applying
imximage: fix commands other than write_data
Where you replied
"This patch breaks building boards with SPL:
Building current source for 85 boards (6 threads, 1 job per thread)
arm: + colibri_vf_dtb
(quoted diff) +5 -0
+Error: Image corrupt DCD size 536870911 exceed maximum 220
+make[2]: *** [u-boot-dtb.imx] Error 1
+make[1]: *** [u-boot-dtb.imx] Error 2
+make: *** [sub-make] Error 2
       arm:  +   mx6sabresd_spl
+Error: Image corrupt DCD size 536870911 exceed maximum 220
"

Quoted 4 lines

Quoted 1 line
Or would you rather that I squash them together?
Yes, please do it - I would like to avoid issues by git bisect.

That is not an issue if you apply "imximage: header.length of 4 is valid" first.

Would you still like it squashed, or a new series, or just use the previous patches ?

Troy

Stefano Babic

2015-10-07 08:01 UTC #4 lore raw

PATCH 1/1 imximage: header.length of 4 is valid

Hi Troy,

Quoted 48 lines · Troy Kisky

Quoted 47 lines · stefano babic
Hi Troy,
Am 06.10.2015 um 00:17 schrieb Troy Kisky:
Quoted 44 lines · Troy Kisky
Quoted 11 lines
Signed-off-by Troy Kisky <[email protected]>
---
 tools/imximage.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
tools/imximage.c +0 -0
index 97a6880..7c21922 100644
tools/imximage.c static void print_hdr_v2(struct imx_header *imx_hdr) · line 403
Quoted 10 lines
tools/imximage.c +2 -2
@@ -396,8 +396,8 @@ static void print_hdr_v2(struct imx_header *imx_hdr)
 	dcd_v2_t *dcd_v2 = &hdr_v2->dcd_table;
 	uint32_t size, version;
 
-	size = be16_to_cpu(dcd_v2->header.length) - 8;
-	if (size > (MAX_HW_CFG_SIZE_V2 * sizeof(dcd_addr_data_t))) {
+	size = be16_to_cpu(dcd_v2->header.length);
+	if (size > (MAX_HW_CFG_SIZE_V2 * sizeof(dcd_addr_data_t)) + 8) {
 		fprintf(stderr,
 			"Error: Image corrupt DCD size %d exceed maximum %d\n",
 			(uint32_t)(size / sizeof(dcd_addr_data_t)),
Hi Stefano,
Are there outstanding concerns about applying this patch and then applying
imximage: fix commands other than write_data
Where you replied
"This patch breaks building boards with SPL:
Building current source for 85 boards (6 threads, 1 job per thread)
arm: + colibri_vf_dtb
(quoted diff) +5 -0
+Error: Image corrupt DCD size 536870911 exceed maximum 220
+make[2]: *** [u-boot-dtb.imx] Error 1
+make[1]: *** [u-boot-dtb.imx] Error 2
+make: *** [sub-make] Error 2
       arm:  +   mx6sabresd_spl
+Error: Image corrupt DCD size 536870911 exceed maximum 220
"

Quoted 7 lines

Quoted 4 lines
Quoted 1 line
Or would you rather that I squash them together?
Yes, please do it - I would like to avoid issues by git bisect.
That is not an issue if you apply "imximage: header.length of 4 is valid" first.

Sorry, you're right, of course !

Quoted 2 lines

Would you still like it squashed, or a new series, or just use the previous patches ?

No, I apply both patches.

Regards,
Stefano

Signature · 5 lines

=====================================================================
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: +49-8142-66989-53 Fax: +49-8142-66989-80 Email: sbabic at denx.de
=====================================================================

Stefano Babic

2015-10-07 12:03 UTC #5 lore raw

PATCH 1/1 imximage: header.length of 4 is valid

In reply to Troy Kisky

Quoted 11 lines · Troy Kisky

Signed-off-by Troy Kisky <[email protected]>
---
 tools/imximage.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
tools/imximage.c +0 -0
index 97a6880..7c21922 100644

tools/imximage.c static void print_hdr_v2(struct imx_header *imx_hdr) · line 403

Quoted 10 lines

tools/imximage.c +2 -2

@@ -396,8 +396,8 @@ static void print_hdr_v2(struct imx_header *imx_hdr)
 	dcd_v2_t *dcd_v2 = &hdr_v2->dcd_table;
 	uint32_t size, version;
 
-	size = be16_to_cpu(dcd_v2->header.length) - 8;
-	if (size > (MAX_HW_CFG_SIZE_V2 * sizeof(dcd_addr_data_t))) {
+	size = be16_to_cpu(dcd_v2->header.length);
+	if (size > (MAX_HW_CFG_SIZE_V2 * sizeof(dcd_addr_data_t)) + 8) {
 		fprintf(stderr,
 			"Error: Image corrupt DCD size %d exceed maximum %d\n",
 			(uint32_t)(size / sizeof(dcd_addr_data_t)),

Applied to u-boot-imx (fix), thanks !

Best regards,
Stefano Babic

Signature · 5 lines

=====================================================================
DENX Software Engineering GmbH,      Managing Director: Wolfgang Denk
HRB 165235 Munich, Office: Kirchenstr.5, D-82194 Groebenzell, Germany
Phone: +49-8142-66989-53 Fax: +49-8142-66989-80 Email: sbabic at denx.de
=====================================================================