summaryrefslogtreecommitdiff
path: root/common/cmd_bootm.c
diff options
context:
space:
mode:
authorKees Cook <keescook@chromium.org>2013-08-16 07:59:16 -0700
committerSimon Glass <sjg@chromium.org>2013-09-03 13:30:26 -0600
commit315c0ace7c220591a9b220ab7698e85624b430c0 (patch)
tree949418163f0c60d0336867d530f53fc5a80ada72 /common/cmd_bootm.c
parentff9d2efdbf1b3b5263f81e843c6724b8bead7f1f (diff)
downloadu-boot-imx-315c0ace7c220591a9b220ab7698e85624b430c0.zip
u-boot-imx-315c0ace7c220591a9b220ab7698e85624b430c0.tar.gz
u-boot-imx-315c0ace7c220591a9b220ab7698e85624b430c0.tar.bz2
bootm: allow correct bounds-check of destination
While nothing presently examines the destination size, it should at least be correct so that future users of sys_mapmem() will not be surprised. Without this, it might be possible to overflow memory. Signed-off-by: Kees Cook <keescook@chromium.org> Acked-by: Simon Glass <sjg@chromium.org>
Diffstat (limited to 'common/cmd_bootm.c')
-rw-r--r--common/cmd_bootm.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/common/cmd_bootm.c b/common/cmd_bootm.c
index 2dd2642..b07b0f4 100644
--- a/common/cmd_bootm.c
+++ b/common/cmd_bootm.c
@@ -368,7 +368,7 @@ static int bootm_load_os(bootm_headers_t *images, unsigned long *load_end,
const char *type_name = genimg_get_type_name(os.type);
- load_buf = map_sysmem(load, image_len);
+ load_buf = map_sysmem(load, unc_len);
image_buf = map_sysmem(image_start, image_len);
switch (comp) {
case IH_COMP_NONE: