[U-Boot] [PATCH] mmc: fix off-by-one bug in mmc_startup_v4()

Alexander Kochetkov al.kochet at gmail.com
Tue Feb 20 11:35:55 UTC 2018


SD-card with EXT_CSD_REV value 9 will trigger off-by-one
bug while accessing mmc_versions array. The patch fix that.

Signed-off-by: Alexander Kochetkov <al.kochet at gmail.com>
---
 drivers/mmc/mmc.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/mmc/mmc.c b/drivers/mmc/mmc.c
index 99e2a75..3aa153a 100644
--- a/drivers/mmc/mmc.c
+++ b/drivers/mmc/mmc.c
@@ -1974,7 +1974,7 @@ static int mmc_startup_v4(struct mmc *mmc)
 		return -ENOMEM;
 	memcpy(mmc->ext_csd, ext_csd, MMC_MAX_BLOCK_LEN);
 
-	if (ext_csd[EXT_CSD_REV] > ARRAY_SIZE(mmc_versions))
+	if (ext_csd[EXT_CSD_REV] >= ARRAY_SIZE(mmc_versions))
 		return -EINVAL;
 
 	mmc->version = mmc_versions[ext_csd[EXT_CSD_REV]];
-- 
1.7.9.5



More information about the U-Boot mailing list