mirrors/u-boot
1
0
Fork 0
mirror of https://source.denx.de/u-boot/u-boot.git synced 2025-09-28 01:01:22 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity

sandbox: usb: Fix out-of-bounds read when fd=-1

Browse Source 
sandbox_flash_bulk uses priv->read_len to determine if priv->buff contains
the response data (such as from SCSI_INQUIRY). However, if priv->fd=-1 in
handle_read, then priv->read_len is not set even though we are going to
PHASE_DATA. This causes sandbox_flash_bulk to try and read len bytes from
priv->buff, which likely goes past the end of the buffer. Fix this by always
setting priv->read_len even if we aren't going to read anything.

Fixes: f4f715360c ("dm: usb: sandbox: Add an emulator for USB flash devices")
Signed-off-by: Sean Anderson <seanga2@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
This commit is contained in:
Sean Anderson 2022-03-23 18:24:38 -04:00 committed by Simon Glass
parent 42ae363ddd
commit 24057fe0a8
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/usb/emul/sandbox_flash.c
View File

@ -228,9 +228,9 @@ static void handle_read(struct sandbox_flash_priv *priv, ulong lba,
ulong transfer_len)
{
debug("%s: lba=%lx, transfer_len=%lx\n", __func__, lba, transfer_len);
priv->read_len = transfer_len;
if (priv->fd != -1) {
os_lseek(priv->fd, lba * SANDBOX_FLASH_BLOCK_LEN, OS_SEEK_SET);
priv->read_len = transfer_len;
setup_response(priv, priv->buff,
transfer_len * SANDBOX_FLASH_BLOCK_LEN);
} else {
@ -336,6 +336,9 @@ static int sandbox_flash_bulk(struct udevice *dev, struct usb_device *udev,
if (priv->read_len) {
ulong bytes_read;
if (priv->fd == -1)
return -EIO;
bytes_read = os_read(priv->fd, buff, len);
if (bytes_read != len)
return -EIO;