[PATCH] cmd: upl: fix off-by-one argc check in do_upl_read

Tom Rini trini at konsulko.com
Sat Jul 11 02:17:24 CEST 2026


On Fri, 26 Jun 2026 09:19:18 +0530, Naveen Kumar Chaudhary wrote:

> do_upl_read() guards against missing arguments with "argc < 1", but
> argc always counts argv[0] (the command name) so that condition is
> never true. The function then unconditionally dereferences argv[1],
> which is out of bounds when the user runs "upl read" with no address
> argument and feeds garbage into hextoul()/map_sysmem().
> 
> Use "argc < 2" so the address argument is actually required.
> 
> [...]

Applied to u-boot/master, thanks!

[1/1] cmd: upl: fix off-by-one argc check in do_upl_read
      commit: bd93d8ea10ec94183fece63fe18b9ead91b8ed67
-- 
Tom




More information about the U-Boot mailing list