Djam/u-boot
1
0
Fork 0
mirror of https://github.com/u-boot/u-boot.git synced 2025-05-08 19:11:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

fastboot: Fix overflow when calculating chunk size

Browse source 
If a chunk was larger than 4GiB, then chunk_data_sz would overflow and
blkcnt would not be calculated correctly. Upgrade it to a u64 and cast
its multiplicands as well. Also fix bytes_written while we're at it.

Signed-off-by: Sean Anderson <sean.anderson@seco.com>
Reviewed-by: Heiko Schocher <hs@denx.de>
This commit is contained in:
Sean Anderson 2021-05-27 12:02:34 -04:00 • committed by Tom Rini
parent d8729a114e
commit 89be8e31cc
1 changed files with 9 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

17
lib/image-sparse.c
View file

@ -55,10 +55,10 @@ int write_sparse_image(struct sparse_storage *info,
lbaint_t blk; lbaint_t blk;
lbaint_t blkcnt; lbaint_t blkcnt;
lbaint_t blks; lbaint_t blks;
uint32_t bytes_written = 0; uint64_t bytes_written = 0;
unsigned int chunk; unsigned int chunk;
unsigned int offset; unsigned int offset;
unsigned int chunk_data_sz; uint64_t chunk_data_sz;
uint32_t *fill_buf = NULL; uint32_t *fill_buf = NULL;
uint32_t fill_val; uint32_t fill_val;
sparse_header_t *sparse_header; sparse_header_t *sparse_header;
@ -132,8 +132,8 @@ int write_sparse_image(struct sparse_storage *info,
sizeof(chunk_header_t)); sizeof(chunk_header_t));
} }
chunk_data_sz = sparse_header->blk_sz * chunk_header->chunk_sz; chunk_data_sz = ((u64)sparse_header->blk_sz) * chunk_header->chunk_sz;
blkcnt = chunk_data_sz / info->blksz; blkcnt = DIV_ROUND_UP_ULL(chunk_data_sz, info->blksz);
switch (chunk_header->chunk_type) { switch (chunk_header->chunk_type) {
case CHUNK_TYPE_RAW: case CHUNK_TYPE_RAW:
if (chunk_header->total_sz != if (chunk_header->total_sz !=
@ -162,7 +162,7 @@ int write_sparse_image(struct sparse_storage *info,
return -1; return -1;
} }
blk += blks; blk += blks;
bytes_written += blkcnt * info->blksz; bytes_written += ((u64)blkcnt) * info->blksz;
total_blocks += chunk_header->chunk_sz; total_blocks += chunk_header->chunk_sz;
data += chunk_data_sz; data += chunk_data_sz;
break; break;
@ -222,8 +222,9 @@ int write_sparse_image(struct sparse_storage *info,
blk += blks; blk += blks;
i += j; i += j;
} }
bytes_written += blkcnt * info->blksz; bytes_written += ((u64)blkcnt) * info->blksz;
total_blocks += chunk_data_sz / sparse_header->blk_sz; total_blocks += DIV_ROUND_UP_ULL(chunk_data_sz,
sparse_header->blk_sz);
free(fill_buf); free(fill_buf);
break; break;
@ -253,7 +254,7 @@ int write_sparse_image(struct sparse_storage *info,
debug("Wrote %d blocks, expected to write %d blocks\n", debug("Wrote %d blocks, expected to write %d blocks\n",
total_blocks, sparse_header->total_blks); total_blocks, sparse_header->total_blks);
printf("........ wrote %u bytes to '%s'\n", bytes_written, part_name); printf("........ wrote %llu bytes to '%s'\n", bytes_written, part_name);
if (total_blocks != sparse_header->total_blks) { if (total_blocks != sparse_header->total_blks) {
info->mssg("sparse image write failure", response); info->mssg("sparse image write failure", response);