diff options
| author | Stewart Smith <stewart@linux.vnet.ibm.com> | 2016-09-01 15:46:47 +1000 |
|---|---|---|
| committer | Stewart Smith <stewart@linux.vnet.ibm.com> | 2016-09-02 15:33:54 +1000 |
| commit | 7bf89d68b8dd3b12d4540e9901f9d5ed325cf94d (patch) | |
| tree | bf8d1bdded8470f55ff52e8d625fdec72d1bed64 /external | |
| parent | 0f1c75dbb52efddb5e37f343433223803163bcbb (diff) | |
| download | skiboot-7bf89d68b8dd3b12d4540e9901f9d5ed325cf94d.zip skiboot-7bf89d68b8dd3b12d4540e9901f9d5ed325cf94d.tar.gz skiboot-7bf89d68b8dd3b12d4540e9901f9d5ed325cf94d.tar.bz2 | |
pflash: fix buffer overflow: fl_total_size uint32_t not uint64_t
This ends up being harmless bug due to memory layout.
$ ./pflash -F ~/op-build/output/images/firestone.pnor -i
==31829==ERROR: AddressSanitizer: global-buffer-overflow on address 0x00000062f0
80 at pc 0x410226 bp 0x7ffedba9c950 sp 0x7ffedba9c948
WRITE of size 8 at 0x00000062f080 thread T0
#0 0x410225 in file_get_info (/home/stewart/skiboot/external/pflash/pflash+0
x410225)
#1 0x40d832 in blocklevel_get_info (/home/stewart/skiboot/external/pflash/pf
lash+0x40d832)
#2 0x401f0c in main (/home/stewart/skiboot/external/pflash/pflash+0x401f0c)
#3 0x7fc77439ab44 in __libc_start_main (/lib/x86_64-linux-gnu/libc.so.6+0x21
b44)
#4 0x403884 (/home/stewart/skiboot/external/pflash/pflash+0x403884)
Signed-off-by: Stewart Smith <stewart@linux.vnet.ibm.com>
Diffstat (limited to 'external')
| -rw-r--r-- | external/pflash/pflash.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/external/pflash/pflash.c b/external/pflash/pflash.c index 2700046..8570acd 100644 --- a/external/pflash/pflash.c +++ b/external/pflash/pflash.c @@ -53,7 +53,8 @@ static uint8_t file_buf[FILE_BUF_SIZE] __aligned(0x1000); static struct blocklevel_device *bl; static struct ffs_handle *ffsh; -static uint32_t fl_total_size, fl_erase_granule; +static uint64_t fl_total_size; +static uint32_t fl_erase_granule; static const char *fl_name; static int32_t ffs_index = -1; |