From 6394f1a24856a614be66237feeb9638e5fb989ff Mon Sep 17 00:00:00 2001 From: funman Date: Sun, 16 May 2010 10:24:31 +0000 Subject: [PATCH] as3525: make sure we don't use a negative number of sectors Better be safe than sorry, don't try to read/write outside our storage, because we might overwrite the OF on the internal storage git-svn-id: svn://svn.rockbox.org/rockbox/trunk@26077 a1c6a512-1295-4272-9138-f99709370657 --- firmware/target/arm/as3525/sd-as3525.c | 7 ++++++- firmware/target/arm/as3525/sd-as3525v2.c | 11 ++++++++--- 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/firmware/target/arm/as3525/sd-as3525.c b/firmware/target/arm/as3525/sd-as3525.c index dea4a578c..5cffced74 100644 --- a/firmware/target/arm/as3525/sd-as3525.c +++ b/firmware/target/arm/as3525/sd-as3525.c @@ -682,11 +682,16 @@ static int sd_transfer_sectors(IF_MD2(int drive,) unsigned long start, goto sd_transfer_error; } - if((start+count) > card_info[drive].numblocks) + if(count < 0) /* XXX: why is it signed ? */ { ret = -20; goto sd_transfer_error; } + if((start+count) > card_info[drive].numblocks) + { + ret = -21; + goto sd_transfer_error; + } /* skip SanDisk OF */ if (drive == INTERNAL_AS3525) diff --git a/firmware/target/arm/as3525/sd-as3525v2.c b/firmware/target/arm/as3525/sd-as3525v2.c index 37d72217b..b61f4dd25 100644 --- a/firmware/target/arm/as3525/sd-as3525v2.c +++ b/firmware/target/arm/as3525/sd-as3525v2.c @@ -809,11 +809,16 @@ static int sd_transfer_sectors(IF_MD2(int drive,) unsigned long start, } } - if((start+count) > card_info[drive].numblocks) + if(count < 0) /* XXX: why is it signed ? */ { ret = -18; goto sd_transfer_error; } + if((start+count) > card_info[drive].numblocks) + { + ret = -19; + goto sd_transfer_error; + } /* skip SanDisk OF */ if (drive == INTERNAL_AS3525) @@ -821,7 +826,7 @@ static int sd_transfer_sectors(IF_MD2(int drive,) unsigned long start, /* CMD7 w/rca: Select card to put it in TRAN state */ if(!send_cmd(drive, SD_SELECT_CARD, card_info[drive].rca, MCI_NO_RESP, NULL)) - return -19; + return -20; last_disk_activity = current_tick; dma_retain(); @@ -911,7 +916,7 @@ static int sd_transfer_sectors(IF_MD2(int drive,) unsigned long start, /* CMD lines are separate, not common, so we need to actively deselect */ /* CMD7 w/rca =0 : deselects card & puts it in STBY state */ if(!send_cmd(drive, SD_DESELECT_CARD, 0, MCI_NO_RESP, NULL)) - return -20; + return -21; #ifndef BOOTLOADER sd_enable(false); -- 2.11.4.GIT