Skip to content
Snippets Groups Projects
  1. Jun 14, 2013
  2. Jun 13, 2013
  3. Jun 12, 2013
  4. Jun 11, 2013
    • Tom Rini's avatar
      077becc3
    • Marek Vasut's avatar
      ppc: ppmc7xx: Fix possible out-of-bound access · 8cf69553
      Marek Vasut authored
      
      The flash_info_t->start[] field is limited in size by CONFIG_SYS_MAX_FLASH_SECT
      macro, which is set to 19 for this board in the board config file. If we inspect
      the board/ppmc7xx/flash.c closely, especially the flash_get_size() function, we
      can notice the "switch ((long)flashtest)" at around line 80 having a few results
      which will set flash_info_t->sector_count to value higher than 19, for example
      "case AMD_ID_LV640U" will set it to 128. Notice that right underneath, iteration
      over flash_info_t->start[] happens and the upper bound for the interation is
      flash_info_t->sector_count. Now if the sector_count is 128 as it is for the
      AMD_ID_LV640U case, but the CONFIG_SYS_MAX_FLASH_SECT limiting the start[] is
      only 19, an access past the start[] array much happen. Moreover, during this
      iteration, the field is written to, so memory corruption is inevitable.
      
      Signed-off-by: default avatarMarek Vasut <marex@denx.de>
      Cc: Wolfgang Denk <wd@denx.de>
      Cc: Tom Rini <trini@ti.com>
      Cc: Richard Danter <richard.danter@windriver.com>
      8cf69553
    • Scott Wood's avatar
      powerpc: fix 8xx and 82xx type-punning warnings with GCC 4.7 · a166fbca
      Scott Wood authored
      
      C99's strict aliasing rules are insane to use in low-level code such as a
      bootloader, but as Wolfgang has rejected -fno-strict-aliasing in the
      past, add a union so that 16-bit accesses can be performed.
      
      Compile-tested only.
      
      Signed-off-by: default avatarScott Wood <scottwood@freescale.com>
      Acked-by: default avatarWolfgang Denk <wd@denx.de>
      a166fbca
  5. Jun 10, 2013
Loading