From 628af1790ac3231455c1ae4a4e43b67136799fa2 Mon Sep 17 00:00:00 2001 From: Simon Glass Date: Fri, 30 Aug 2013 11:00:09 -0600 Subject: sandbox: Correct compiler warnings in cmd_bootm/cmd_ximg Correct the following warnings found with sandbox when compression is enabled. cmd_bootm.c: In function 'bootm_load_os': cmd_bootm.c:443:11: warning: passing argument 4 of 'lzop_decompress' from incompatible pointer type [enabled by default] /usr/local/google/c/cosarm/src/third_party/u-boot/files/include/linux/lzo.h:31:5: note: expected 'size_t *' but argument is of type 'uint *' cmd_ximg.c: In function 'do_imgextract': cmd_ximg.c:225:6: warning: cast to pointer from integer of different size [-Wint-to-pointer-cast] cmd_ximg.c:225:14: warning: 'hdr' may be used uninitialized in this function [-Wuninitialized] Signed-off-by: Simon Glass Acked-by: Kees Cook --- common/cmd_bootm.c | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) (limited to 'common/cmd_bootm.c') diff --git a/common/cmd_bootm.c b/common/cmd_bootm.c index 1685c14a5..2dd264272 100644 --- a/common/cmd_bootm.c +++ b/common/cmd_bootm.c @@ -436,11 +436,12 @@ static int bootm_load_os(bootm_headers_t *images, unsigned long *load_end, } #endif /* CONFIG_LZMA */ #ifdef CONFIG_LZO - case IH_COMP_LZO: + case IH_COMP_LZO: { + size_t size; + printf(" Uncompressing %s ... ", type_name); - ret = lzop_decompress(image_buf, image_len, load_buf, - &unc_len); + ret = lzop_decompress(image_buf, image_len, load_buf, &size); if (ret != LZO_E_OK) { printf("LZO: uncompress or overwrite error %d " "- must RESET board to recover\n", ret); @@ -449,8 +450,9 @@ static int bootm_load_os(bootm_headers_t *images, unsigned long *load_end, return BOOTM_ERR_RESET; } - *load_end = load + unc_len; + *load_end = load + size; break; + } #endif /* CONFIG_LZO */ default: printf("Unimplemented compression type %d\n", comp); -- cgit v1.2.3-70-g09d2 From 315c0ace7c220591a9b220ab7698e85624b430c0 Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Fri, 16 Aug 2013 07:59:16 -0700 Subject: bootm: allow correct bounds-check of destination While nothing presently examines the destination size, it should at least be correct so that future users of sys_mapmem() will not be surprised. Without this, it might be possible to overflow memory. Signed-off-by: Kees Cook Acked-by: Simon Glass --- common/cmd_bootm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'common/cmd_bootm.c') diff --git a/common/cmd_bootm.c b/common/cmd_bootm.c index 2dd264272..b07b0f48b 100644 --- a/common/cmd_bootm.c +++ b/common/cmd_bootm.c @@ -368,7 +368,7 @@ static int bootm_load_os(bootm_headers_t *images, unsigned long *load_end, const char *type_name = genimg_get_type_name(os.type); - load_buf = map_sysmem(load, image_len); + load_buf = map_sysmem(load, unc_len); image_buf = map_sysmem(image_start, image_len); switch (comp) { case IH_COMP_NONE: -- cgit v1.2.3-70-g09d2