Files
u-boot-tk1-som/include/configs
Marek Vasut 8cf695537f ppc: ppmc7xx: Fix possible out-of-bound access
The flash_info_t->start[] field is limited in size by CONFIG_SYS_MAX_FLASH_SECT
macro, which is set to 19 for this board in the board config file. If we inspect
the board/ppmc7xx/flash.c closely, especially the flash_get_size() function, we
can notice the "switch ((long)flashtest)" at around line 80 having a few results
which will set flash_info_t->sector_count to value higher than 19, for example
"case AMD_ID_LV640U" will set it to 128. Notice that right underneath, iteration
over flash_info_t->start[] happens and the upper bound for the interation is
flash_info_t->sector_count. Now if the sector_count is 128 as it is for the
AMD_ID_LV640U case, but the CONFIG_SYS_MAX_FLASH_SECT limiting the start[] is
only 19, an access past the start[] array much happen. Moreover, during this
iteration, the field is written to, so memory corruption is inevitable.

Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Wolfgang Denk <wd@denx.de>
Cc: Tom Rini <trini@ti.com>
Cc: Richard Danter <richard.danter@windriver.com>
2013-06-11 22:11:38 +02:00
..
2013-04-12 21:42:17 +05:30
2013-04-28 11:07:41 +02:00
2012-01-26 16:09:06 -06:00
2011-10-05 22:22:16 +02:00
2013-04-15 16:13:51 -07:00
2012-02-12 15:03:25 -05:00
2013-03-25 09:56:05 -07:00
2013-05-10 08:25:56 -04:00
2012-02-03 20:44:54 -05:00
2011-10-27 21:56:37 +02:00
2012-05-15 08:31:21 +02:00
2012-12-17 15:38:14 +01:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2012-10-03 16:43:12 +05:30
2013-01-09 04:12:11 +05:30
2013-04-22 09:53:53 +02:00
2013-05-05 17:54:44 +02:00
2012-10-17 07:59:08 -07:00
2013-04-28 11:07:41 +02:00
2013-03-07 17:22:58 +01:00
2013-04-03 11:26:12 +02:00
2013-04-28 11:07:42 +02:00
2013-04-25 21:48:21 +02:00
2013-04-25 21:48:21 +02:00
2012-10-17 07:59:08 -07:00
2012-11-10 19:45:58 +08:00
2013-03-29 09:35:34 +01:00
2012-10-17 07:59:08 -07:00
2013-04-28 11:07:41 +02:00
2012-11-10 19:45:58 +08:00
2012-02-12 15:03:25 -05:00
2013-01-13 11:39:57 +01:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2013-03-12 19:24:24 +09:00
2012-10-17 07:59:08 -07:00
2013-04-15 11:01:37 -07:00
2012-07-07 14:07:33 +02:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2012-10-17 07:59:08 -07:00
2013-05-01 16:24:03 -04:00
2012-10-17 07:59:08 -07:00
2013-04-12 22:08:55 +02:00
2012-10-17 07:59:08 -07:00