summaryrefslogtreecommitdiff
path: root/common
diff options
context:
space:
mode:
authorTaylor Hutt <thutt@chromium.org>2012-11-22 09:13:00 +0000
committerAndy Fleming <afleming@freescale.com>2012-11-27 17:26:49 -0600
commited80c931ba7781e6605b9bdaa2a0d58ef365fe71 (patch)
tree7a53d7cc2d493b2e7bad57a88b764892d64e9eb7 /common
parent1981539914b3626efe4a97bde19ec5fe548b50cf (diff)
downloadu-boot-imx-ed80c931ba7781e6605b9bdaa2a0d58ef365fe71.zip
u-boot-imx-ed80c931ba7781e6605b9bdaa2a0d58ef365fe71.tar.gz
u-boot-imx-ed80c931ba7781e6605b9bdaa2a0d58ef365fe71.tar.bz2
mmc: Fix incorrect handling of 'read' & 'write' commands
If a malformed 'read' or 'write' command is issued, the Sandbox U-Boot can crash because the command-handling code does no error checking on the number of provided arguments. This change makes the mmc 'erase', 'read' and 'write' commands only function if the proper number of arguments are supplied. Also puts the else assignment at the beginning fo the if() statement to shortens the generated code. This removes an unnecessary jump from the generated code. Signed-off-by: Taylor Hutt <thutt@chromium.org> Signed-off-by: Simon Glass <sjg@chromium.org> Signed-off-by: Andy Fleming <afleming@freescale.com>
Diffstat (limited to 'common')
-rw-r--r--common/cmd_mmc.c9
1 files changed, 4 insertions, 5 deletions
diff --git a/common/cmd_mmc.c b/common/cmd_mmc.c
index 4c19df7..7dacd51 100644
--- a/common/cmd_mmc.c
+++ b/common/cmd_mmc.c
@@ -250,14 +250,13 @@ static int do_mmcops(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
return 0;
}
- if (strcmp(argv[1], "read") == 0)
+ state = MMC_INVALID;
+ if (argc == 5 && strcmp(argv[1], "read") == 0)
state = MMC_READ;
- else if (strcmp(argv[1], "write") == 0)
+ else if (argc == 5 && strcmp(argv[1], "write") == 0)
state = MMC_WRITE;
- else if (strcmp(argv[1], "erase") == 0)
+ else if (argc == 4 && strcmp(argv[1], "erase") == 0)
state = MMC_ERASE;
- else
- state = MMC_INVALID;
if (state != MMC_INVALID) {
struct mmc *mmc = find_mmc_device(curr_device);