[U-Boot] [Patch V2 3/3] dfu: dfu_get_buf: check the value of env dfu_bufsiz before use

[Lukasz Majewski]

Hi Przemyslaw,

> In function dfu_get_buf(), the size of allocated buffer could
> be defined by the env variable. The size from this variable
> was passed for memalign() without checking its value.
> And the the memalign will return non null pointer for size 0.
> 
> This could possibly cause data abort, so now the value of var
> is checked before use. And if this variable is set to 0 then
> the default size will be used.
> 
> This commit also changes the base passed to simple_strtoul()
> to 0. Now decimal and hex values can be used for the variable
> dfu_bufsiz.
> 
> Signed-off-by: Przemyslaw Marczak <p.marczak at samsung.com>
> ---
> Change v2:
> - new patch
> ---
>  drivers/dfu/dfu.c | 8 ++++++--
>  1 file changed, 6 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/dfu/dfu.c b/drivers/dfu/dfu.c
> index c0aba6e..49abd85 100644
> --- a/drivers/dfu/dfu.c
> +++ b/drivers/dfu/dfu.c
> @@ -111,8 +111,12 @@ unsigned char *dfu_get_buf(struct dfu_entity
> *dfu) return dfu_buf;
>  
>  	s = getenv("dfu_bufsiz");
> -	dfu_buf_size = s ? (unsigned long)simple_strtol(s, NULL,
> 16) :
> -			CONFIG_SYS_DFU_DATA_BUF_SIZE;
> +	if (s)
> +		dfu_buf_size = (unsigned long)simple_strtol(s, NULL,
> 0); +
> +	if (!s || !dfu_buf_size)
> +		dfu_buf_size = CONFIG_SYS_DFU_DATA_BUF_SIZE;
> +
>  	if (dfu->max_buf_size && dfu_buf_size > dfu->max_buf_size)
>  		dfu_buf_size = dfu->max_buf_size;
>  

Applied to u-boot-dfu, thanks!

-- 
Best regards,

Lukasz Majewski

Samsung R&D Institute Poland (SRPOL) | Linux Platform Group