diff options
| author | Wolfgang Denk <wd@denx.de> | 2010-04-28 10:53:47 +0200 |
|---|---|---|
| committer | Wolfgang Denk <wd@denx.de> | 2010-04-28 10:53:47 +0200 |
| commit | 2697eff1af136c6424c065cba994aa9aceadbcd1 (patch) | |
| tree | 916595beae9ff3063e15b7be9ac5dec13651558f | |
| parent | 3699c28e6d16b563629c285311a0ce62a2c4c5d0 (diff) | |
mtdparts: fix write through NULL pointer
The "mtdparts add" command wrote through a NULL pointer - on many
systems this went unnoticed (PowerPC has writable RAM there, some ARM
systems have ROM where a write has no effect), but on arm1136
(i.MX31) it crashed the system.
Add appropriate checks.
Signed-off-by: Wolfgang Denk <wd@denx.de>
| -rw-r--r-- | common/cmd_mtdparts.c | 19 |
1 files changed, 12 insertions, 7 deletions
diff --git a/common/cmd_mtdparts.c b/common/cmd_mtdparts.c index 0b5f747141..cec154c702 100644 --- a/common/cmd_mtdparts.c +++ b/common/cmd_mtdparts.c @@ -837,14 +837,16 @@ static int device_parse(const char *const mtd_dev, const char **ret, struct mtd_ u32 offset; int err = 1; - p = mtd_dev; + DEBUGF("===device_parse===\n"); + + assert(retdev); *retdev = NULL; - *ret = NULL; - DEBUGF("===device_parse===\n"); + if (ret) + *ret = NULL; /* fetch <mtd-id> */ - mtd_id = p; + mtd_id = p = mtd_dev; if (!(p = strchr(mtd_id, ':'))) { printf("no <mtd-id> identifier\n"); return 1; @@ -913,12 +915,15 @@ static int device_parse(const char *const mtd_dev, const char **ret, struct mtd_ /* check for next device presence */ if (p) { if (*p == ';') { - *ret = ++p; + if (ret) + *ret = ++p; } else if (*p == '\0') { - *ret = p; + if (ret) + *ret = p; } else { printf("unexpected character '%c' at the end of device\n", *p); - *ret = NULL; + if (ret) + *ret = NULL; return 1; } } |