Files
u-boot-tk1-som/include
Marek Vasut 8cf695537f ppc: ppmc7xx: Fix possible out-of-bound access
The flash_info_t->start[] field is limited in size by CONFIG_SYS_MAX_FLASH_SECT
macro, which is set to 19 for this board in the board config file. If we inspect
the board/ppmc7xx/flash.c closely, especially the flash_get_size() function, we
can notice the "switch ((long)flashtest)" at around line 80 having a few results
which will set flash_info_t->sector_count to value higher than 19, for example
"case AMD_ID_LV640U" will set it to 128. Notice that right underneath, iteration
over flash_info_t->start[] happens and the upper bound for the interation is
flash_info_t->sector_count. Now if the sector_count is 128 as it is for the
AMD_ID_LV640U case, but the CONFIG_SYS_MAX_FLASH_SECT limiting the start[] is
only 19, an access past the start[] array much happen. Moreover, during this
iteration, the field is written to, so memory corruption is inevitable.

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Wolfgang Denk <wd@denx.de>
Cc: Tom Rini <trini@ti.com>
Cc: Richard Danter <richard.danter@windriver.com>
2013-06-11 22:11:38 +02:00
..
2013-04-01 16:33:52 -04:00
2013-04-01 16:33:52 -04:00
2010-04-13 09:13:04 +02:00
2013-02-20 16:48:17 +09:00
2013-05-05 17:55:05 +02:00
2012-08-09 23:42:20 +02:00
2011-08-01 15:19:40 +02:00
2012-05-15 08:31:37 +02:00
2012-11-02 15:20:41 -07:00
2011-08-04 23:34:02 +02:00
2010-01-27 21:23:14 +01:00
2013-04-01 16:33:52 -04:00
2012-12-06 13:56:39 -07:00
2012-03-27 22:05:28 +02:00
2013-03-12 23:28:40 +01:00
2013-04-28 11:07:40 +02:00
2009-01-24 00:23:09 +01:00
2009-09-04 21:54:52 +02:00
2011-10-22 01:22:21 +02:00
2012-12-11 13:17:34 -07:00
2010-09-19 19:29:47 +02:00
2013-02-19 17:01:26 -05:00
2011-08-04 23:34:02 +02:00
2013-05-14 16:00:26 -05:00
2012-10-22 14:31:25 -05:00
2012-05-15 08:31:34 +02:00
2013-04-28 11:07:40 +02:00
2012-11-27 09:41:10 -07:00
2013-03-29 20:10:42 +09:00
2013-01-08 10:54:33 +09:00
2012-11-15 21:08:20 +09:00
2013-03-15 16:14:00 -04:00
2009-10-13 06:17:35 -05:00
2012-05-25 09:15:10 +02:00
2013-04-01 16:33:52 -04:00
2012-10-26 16:28:07 +02:00
2012-10-23 15:23:26 -05:00
2013-05-31 17:12:03 -05:00
2013-06-04 16:06:31 -04:00
2010-03-21 22:44:42 +01:00
2013-05-10 08:25:55 -04:00
2010-03-12 23:06:04 +01:00
2011-10-05 22:03:11 +02:00
2011-03-27 19:19:54 +02:00
2013-04-01 16:33:52 -04:00
2012-11-27 17:26:48 -06:00
2011-08-04 23:34:02 +02:00
2011-08-04 23:34:02 +02:00
2011-08-01 15:19:40 +02:00
2013-05-10 08:25:56 -04:00
2012-11-10 19:45:58 +08:00
2009-10-03 10:17:56 +02:00
2013-04-01 16:33:52 -04:00
2012-05-15 08:31:40 +02:00
2013-04-12 14:13:13 -07:00
2013-04-12 14:13:13 -07:00
2012-05-15 08:31:37 +02:00
2011-04-29 07:32:48 -05:00
2013-05-10 08:25:54 -04:00
2013-04-01 16:33:52 -04:00
2011-08-01 15:19:40 +02:00
2012-10-15 11:53:59 -07:00
2013-04-01 16:33:52 -04:00