spl: ymodem: Fix buffer overflow during Image copy
authorVignesh Raghavendra <vigneshr@ti.com>
Mon, 31 Jan 2022 04:19:19 +0000 (09:49 +0530)
committerTom Rini <trini@konsulko.com>
Thu, 3 Feb 2022 17:15:33 +0000 (12:15 -0500)
commitc1335e2ca5e3947a61d93c094fbb4a9be9afc4ff
tree9122ad795a9164f943255e208243d9070bdbd13e
parentcd59d44cfd5daebaab4b01a0a5f2931f9e4ed834
spl: ymodem: Fix buffer overflow during Image copy

ymodem_read_fit() driver will end copying up to BUF_SIZE boundary even
when requested size of copy operation is less than that.
For example, if offset = 0, size = 1440B, ymodem_read_fit() ends up
copying 2KB from offset = 0, to destination buffer addr

This causes data corruption when malloc'd buffer is passed during UART
boot since commit 03f1f78a9b44 ("spl: fit: Prefer a malloc()'d buffer
for loading images")

With this, UART boot works again on K3 (AM654, J7, AM64) family of
devices.

Fixes: 03f1f78a9b44 ("spl: fit: Prefer a malloc()'d buffer for loading images")
Signed-off-by: Vignesh Raghavendra <vigneshr@ti.com>
common/spl/spl_ymodem.c