diff options
| author | htbegin <hotforest@gmail.com> | 2013-03-01 23:00:34 +0000 |
|---|---|---|
| committer | Scott Wood <scottwood@freescale.com> | 2013-05-22 16:50:59 -0500 |
| commit | 453db36863668df08078838029d988b72f0ee994 (patch) | |
| tree | 8ffda41510fae2a2f91967e096dc3e368e4ee74f /drivers | |
| parent | 070fd8e5295185546801a0f11ea5edd22833a02b (diff) | |
| download | u-boot-imx-453db36863668df08078838029d988b72f0ee994.zip u-boot-imx-453db36863668df08078838029d988b72f0ee994.tar.gz u-boot-imx-453db36863668df08078838029d988b72f0ee994.tar.bz2 | |
mtd: nand: use ssize_t instead of size_t to prevent infinite loop
When a all 0xFF buffer is passed to drop_ffs, the no-0xFF check loop
will loop forever.
After the fix, If ssize_t i = -1 and size_t l = i + 1, the value of l
will still be 0 as expected.
Signed-off-by: Tao Hou <hotforest@gmail.com>
Cc: Ben Gardiner <bengardiner@nanometrics.ca>
Cc: Scott Wood <scottwood@freescale.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/mtd/nand/nand_util.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/mtd/nand/nand_util.c b/drivers/mtd/nand/nand_util.c index 4727f9c..fe8bdeb 100644 --- a/drivers/mtd/nand/nand_util.c +++ b/drivers/mtd/nand/nand_util.c @@ -458,7 +458,8 @@ static int check_skip_len(nand_info_t *nand, loff_t offset, size_t length, static size_t drop_ffs(const nand_info_t *nand, const u_char *buf, const size_t *len) { - size_t i, l = *len; + size_t l = *len; + ssize_t i; for (i = l - 1; i >= 0; i--) if (buf[i] != 0xFF) |