Commit ed80c931ba7781e6605b9bdaa2a0d58ef365fe71
Committed by
Andy Fleming
Andy Fleming
1 parent
1981539914
Exists in
master
and in
54 other branches
mmc: Fix incorrect handling of 'read' & 'write' commands
If a malformed 'read' or 'write' command is issued, the Sandbox U-Boot can crash because the command-handling code does no error checking on the number of provided arguments. This change makes the mmc 'erase', 'read' and 'write' commands only function if the proper number of arguments are supplied. Also puts the else assignment at the beginning fo the if() statement to shortens the generated code. This removes an unnecessary jump from the generated code. Signed-off-by: Taylor Hutt <thutt@chromium.org> Signed-off-by: Simon Glass <sjg@chromium.org> Signed-off-by: Andy Fleming <afleming@freescale.com>
Showing 1 changed file with 4 additions and 5 deletions Side-by-side Diff
common/cmd_mmc.c
| ... | ... | @@ -250,14 +250,13 @@ |
| 250 | 250 | return 0; |
| 251 | 251 | } |
| 252 | 252 | |
| 253 | - if (strcmp(argv[1], "read") == 0) | |
| 253 | + state = MMC_INVALID; | |
| 254 | + if (argc == 5 && strcmp(argv[1], "read") == 0) | |
| 254 | 255 | state = MMC_READ; |
| 255 | - else if (strcmp(argv[1], "write") == 0) | |
| 256 | + else if (argc == 5 && strcmp(argv[1], "write") == 0) | |
| 256 | 257 | state = MMC_WRITE; |
| 257 | - else if (strcmp(argv[1], "erase") == 0) | |
| 258 | + else if (argc == 4 && strcmp(argv[1], "erase") == 0) | |
| 258 | 259 | state = MMC_ERASE; |
| 259 | - else | |
| 260 | - state = MMC_INVALID; | |
| 261 | 260 | |
| 262 | 261 | if (state != MMC_INVALID) { |
| 263 | 262 | struct mmc *mmc = find_mmc_device(curr_device); |