From 7d7ce4125f769a21a321c3df972272c5854d54f7 Mon Sep 17 00:00:00 2001 From: wdenk Date: Wed, 17 Mar 2004 01:13:07 +0000 Subject: [PATCH] Patch by Pierre Aubert, 15 Mar 2004: Fix buffer overflow in IDE identification --- CHANGELOG | 11 ++++++++-- common/cmd_ide.c | 42 +++++++++++++++++++----------------- cpu/mpc8xx/lcd.c | 2 +- include/configs/IceCube.h | 1 - include/part.h | 6 +++--- post/sysmon.c | 54 +++++++++++++++++------------------------------ 6 files changed, 55 insertions(+), 61 deletions(-) diff --git a/CHANGELOG b/CHANGELOG index 189c130..8703189 100644 --- a/CHANGELOG +++ b/CHANGELOG @@ -2,6 +2,13 @@ Changes for U-Boot 1.0.2: ====================================================================== +* Patch by Pierre Aubert, 15 Mar 2004: + Fix buffer overflow in IDE identification + +* Fix power-off of LCD for out-of-band temperatures on LWMON board + +* Remove redundand #define in IceCube.h + * Patch by Steven Scholz, 27 Feb 2004: - Adding get_ticks() and get_tbclk() for AT91RM9200 - Many white space fixes in cpu/at91rm9200/interrupts.c @@ -29,7 +36,7 @@ Changes for U-Boot 1.0.2: * Patch by George G. Davis, 11 Mar 2004: add support for ADS GraphicsClient+ board. -* Patch by Pierre Aubert, 11 Mar 2004: +* Patch by Pierre Aubert, 11 Mar 2004: - add bitmap command and splash screen support in cfb console - add [optional] origin in the bitmap display command @@ -57,7 +64,7 @@ Changes for U-Boot 1.0.2: Don't overwrite server IP address or boot file name when the boot server does not return values -* Patch by listmember@orkun.us, 5 Mar 2004: +* Patch by Tolunay Orkun, 5 Mar 2004: Removed compile time restriction on CFG_I2C_SPEED for DS1338 RTC * Patch by Tolunay Orkun, 5 Mar 2004: diff --git a/common/cmd_ide.c b/common/cmd_ide.c index 2b8b2bc..8644d98 100644 --- a/common/cmd_ide.c +++ b/common/cmd_ide.c @@ -1410,27 +1410,31 @@ WR_OUT: /* * copy src to dest, skipping leading and trailing blanks and null * terminate the string + * "len" is the size of available memory including the terminating '\0' */ -static void ident_cpy (unsigned char *dest, unsigned char *src, unsigned int len) +static void ident_cpy (unsigned char *dst, unsigned char *src, unsigned int len) { - int start,end; - - start=0; - while (startstart) { - if (src[end]!=' ') - break; - end--; - } - for ( ; start<=end; start++) { - *dest++=src[start]; - } - *dest='\0'; + unsigned char *end, *last; + + last = dst; + end = src + len; + + /* reserve space for '\0' */ + if (len < 2) + goto OUT; + + /* skip leading white space */ + while ((*src) && (srcinit(*l); } @@ -165,15 +164,13 @@ void sysmon_reloc (void) sysmon_t ** l; sysmon_table_t * t; - for (l = sysmon_list; *l; l++) - { + for (l = sysmon_list; *l; l++) { RELOC(*l); RELOC((*l)->init); RELOC((*l)->read); } - for (t = sysmon_table; t < sysmon_table + sysmon_table_size; t ++) - { + for (t = sysmon_table; t < sysmon_table + sysmon_table_size; t ++) { RELOC(t->exec_before); RELOC(t->exec_after); RELOC(t->sysmon); @@ -204,12 +201,10 @@ static char *sysmon_unit_value (sysmon_table_t *s, uint val) dec = s->unit_precision; - if (dec != 1) - { + if (dec != 1) { *p++ = '.'; } - for (dec /= 10; dec != 0; dec /= 10) - { + for (dec /= 10; dec != 0; dec /= 10) { *p++ = '0' + (frac / dec) % 10; } strcpy(p, s->unit_name); @@ -223,24 +218,21 @@ static void sysmon_lm87_init (sysmon_t * this) /* Detect LM87 chip */ if (i2c_read(this->chip, 0x40, 1, &val, 1) || (val & 0x80) != 0 || - i2c_read(this->chip, 0x3E, 1, &val, 1) || val != 0x02) - { + i2c_read(this->chip, 0x3E, 1, &val, 1) || val != 0x02) { printf("Error: LM87 not found at 0x%02X\n", this->chip); return; } /* Configure pins 5,6 as AIN */ val = 0x03; - if (i2c_write(this->chip, 0x16, 1, &val, 1)) - { + if (i2c_write(this->chip, 0x16, 1, &val, 1)) { printf("Error: can't write LM87 config register\n"); return; } /* Start monitoring */ val = 0x01; - if (i2c_write(this->chip, 0x40, 1, &val, 1)) - { + if (i2c_write(this->chip, 0x40, 1, &val, 1)) { printf("Error: can't write LM87 config register\n"); return; } @@ -267,8 +259,7 @@ static uint sysmon_i2c_read_sgn (sysmon_t * this, uint addr) static void sysmon_ccfl_disable (sysmon_table_t * this) { - if (!this->val_valid_alt) - { + if (!this->val_valid_alt) { sysmon_temp_invalid = 1; } } @@ -277,10 +268,9 @@ static void sysmon_ccfl_enable (sysmon_table_t * this) { ulong reg; - if (!sysmon_temp_invalid) - { + if (!sysmon_temp_invalid) { reg = pic_read (0x60); - reg |= 0x02; + reg |= 0x06; pic_write (0x60, reg); } } @@ -296,16 +286,13 @@ int sysmon_post_test (int flags) /* * The A/D conversion on the LM87 sensor takes 300 ms. */ - if (! conversion_done) - { + if (! conversion_done) { while (post_time_ms(gd->post_init_f_time) < 300) WATCHDOG_RESET (); conversion_done = 1; } - for (t = sysmon_table; t < sysmon_table + sysmon_table_size; t ++) - { - if (t->exec_before) - { + for (t = sysmon_table; t < sysmon_table + sysmon_table_size; t ++) { + if (t->exec_before) { t->exec_before(t); } @@ -313,13 +300,11 @@ int sysmon_post_test (int flags) t->val_valid = val >= t->val_min && val <= t->val_max; t->val_valid_alt = val >= t->val_min_alt && val <= t->val_max_alt; - if (t->exec_after) - { + if (t->exec_after) { t->exec_after(t); } - if ((!t->val_valid) || (flags & POST_MANUAL)) - { + if ((!t->val_valid) || (flags & POST_MANUAL)) { printf("%-17s = %-10s ", t->name, sysmon_unit_value(t, val)); printf("allowed range"); printf(" %-8s ..", sysmon_unit_value(t, t->val_min)); @@ -327,8 +312,7 @@ int sysmon_post_test (int flags) printf(" %s\n", t->val_valid ? "OK" : "FAIL"); } - if (!t->val_valid) - { + if (!t->val_valid) { res = -1; } } -- 2.7.4