load_uboot_image: don't assume a full header read

[Qemu-devel] [PATCH] load_uboot_image: don't assume a full header read

Andrew Jones posted 1 patch 6 years, 11 months ago

Download mbox

Patches applied successfully (tree, apply log)
git fetch https://github.com/patchew-project/qemu tags/patchew/20170524091315.20284-1-drjones@redhat.com

Test checkpatch passed

Test docker passed

Test s390x passed

hw/core/loader.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)

Expand all Fold all

[Qemu-devel] [PATCH] load_uboot_image: don't assume a full header read

Posted by Andrew Jones 6 years, 11 months ago

Don't allow load_uboot_image() to proceed when less bytes than
header-size was read.

Signed-off-by: Andrew Jones <drjones@redhat.com>
---
 hw/core/loader.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/hw/core/loader.c b/hw/core/loader.c
index bf17b42cbec2..f72930ca4a41 100644
--- a/hw/core/loader.c
+++ b/hw/core/loader.c
@@ -611,8 +611,9 @@ static int load_uboot_image(const char *filename, hwaddr *ep, hwaddr *loadaddr,
         return -1;
 
     size = read(fd, hdr, sizeof(uboot_image_header_t));
-    if (size < 0)
+    if (size < sizeof(uboot_image_header_t)) {
         goto out;
+    }
 
     bswap_uboot_header(hdr);
 
-- 
2.9.4

Re: [Qemu-devel] [PATCH] load_uboot_image: don't assume a full header read

Posted by Peter Maydell 6 years, 10 months ago

On 24 May 2017 at 10:13, Andrew Jones <drjones@redhat.com> wrote:
> Don't allow load_uboot_image() to proceed when less bytes than
> header-size was read.
>
> Signed-off-by: Andrew Jones <drjones@redhat.com>
> ---
>  hw/core/loader.c | 3 ++-
>  1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/hw/core/loader.c b/hw/core/loader.c
> index bf17b42cbec2..f72930ca4a41 100644
> --- a/hw/core/loader.c
> +++ b/hw/core/loader.c
> @@ -611,8 +611,9 @@ static int load_uboot_image(const char *filename, hwaddr *ep, hwaddr *loadaddr,
>          return -1;
>
>      size = read(fd, hdr, sizeof(uboot_image_header_t));
> -    if (size < 0)
> +    if (size < sizeof(uboot_image_header_t)) {
>          goto out;
> +    }
>
>      bswap_uboot_header(hdr);
>



Applied to target-arm.next, thanks.

-- PMM