diff options
| author | Kees Cook <keescook@chromium.org> | 2013-08-16 07:59:16 -0700 |
|---|---|---|
| committer | Simon Glass <sjg@chromium.org> | 2013-09-03 13:30:26 -0600 |
| commit | 315c0ace7c220591a9b220ab7698e85624b430c0 (patch) | |
| tree | 949418163f0c60d0336867d530f53fc5a80ada72 /common | |
| parent | ff9d2efdbf1b3b5263f81e843c6724b8bead7f1f (diff) | |
| download | u-boot-imx-315c0ace7c220591a9b220ab7698e85624b430c0.zip u-boot-imx-315c0ace7c220591a9b220ab7698e85624b430c0.tar.gz u-boot-imx-315c0ace7c220591a9b220ab7698e85624b430c0.tar.bz2 | |
bootm: allow correct bounds-check of destination
While nothing presently examines the destination size, it should at
least be correct so that future users of sys_mapmem() will not be
surprised. Without this, it might be possible to overflow memory.
Signed-off-by: Kees Cook <keescook@chromium.org>
Acked-by: Simon Glass <sjg@chromium.org>
Diffstat (limited to 'common')
| -rw-r--r-- | common/cmd_bootm.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/common/cmd_bootm.c b/common/cmd_bootm.c index 2dd2642..b07b0f4 100644 --- a/common/cmd_bootm.c +++ b/common/cmd_bootm.c @@ -368,7 +368,7 @@ static int bootm_load_os(bootm_headers_t *images, unsigned long *load_end, const char *type_name = genimg_get_type_name(os.type); - load_buf = map_sysmem(load, image_len); + load_buf = map_sysmem(load, unc_len); image_buf = map_sysmem(image_start, image_len); switch (comp) { case IH_COMP_NONE: |