diff options
author | wdenk <wdenk> | 2004-03-17 01:13:07 +0000 |
---|---|---|
committer | wdenk <wdenk> | 2004-03-17 01:13:07 +0000 |
commit | 7d7ce4125f769a21a321c3df972272c5854d54f7 (patch) | |
tree | ca95548f218169750a0b3d3ddf72e3464d9f8d0d | |
parent | d9df1f4e662441c487f96a4e1f91caa9297afdd9 (diff) |
Patch by Pierre Aubert, 15 Mar 2004:
Fix buffer overflow in IDE identification
-rw-r--r-- | CHANGELOG | 11 | ||||
-rw-r--r-- | common/cmd_ide.c | 42 | ||||
-rw-r--r-- | cpu/mpc8xx/lcd.c | 2 | ||||
-rw-r--r-- | include/configs/IceCube.h | 1 | ||||
-rw-r--r-- | include/part.h | 6 | ||||
-rw-r--r-- | post/sysmon.c | 54 |
6 files changed, 55 insertions, 61 deletions
@@ -2,6 +2,13 @@ Changes for U-Boot 1.0.2: ====================================================================== +* Patch by Pierre Aubert, 15 Mar 2004: + Fix buffer overflow in IDE identification + +* Fix power-off of LCD for out-of-band temperatures on LWMON board + +* Remove redundand #define in IceCube.h + * Patch by Steven Scholz, 27 Feb 2004: - Adding get_ticks() and get_tbclk() for AT91RM9200 - Many white space fixes in cpu/at91rm9200/interrupts.c @@ -29,7 +36,7 @@ Changes for U-Boot 1.0.2: * Patch by George G. Davis, 11 Mar 2004: add support for ADS GraphicsClient+ board. -* Patch by Pierre Aubert, 11 Mar 2004: +* Patch by Pierre Aubert, 11 Mar 2004: - add bitmap command and splash screen support in cfb console - add [optional] origin in the bitmap display command @@ -57,7 +64,7 @@ Changes for U-Boot 1.0.2: Don't overwrite server IP address or boot file name when the boot server does not return values -* Patch by listmember@orkun.us, 5 Mar 2004: +* Patch by Tolunay Orkun, 5 Mar 2004: Removed compile time restriction on CFG_I2C_SPEED for DS1338 RTC * Patch by Tolunay Orkun, 5 Mar 2004: diff --git a/common/cmd_ide.c b/common/cmd_ide.c index 2b8b2bc946..8644d986b5 100644 --- a/common/cmd_ide.c +++ b/common/cmd_ide.c @@ -1410,27 +1410,31 @@ WR_OUT: /* * copy src to dest, skipping leading and trailing blanks and null * terminate the string + * "len" is the size of available memory including the terminating '\0' */ -static void ident_cpy (unsigned char *dest, unsigned char *src, unsigned int len) +static void ident_cpy (unsigned char *dst, unsigned char *src, unsigned int len) { - int start,end; - - start=0; - while (start<len) { - if (src[start]!=' ') - break; - start++; - } - end=len-1; - while (end>start) { - if (src[end]!=' ') - break; - end--; - } - for ( ; start<=end; start++) { - *dest++=src[start]; - } - *dest='\0'; + unsigned char *end, *last; + + last = dst; + end = src + len; + + /* reserve space for '\0' */ + if (len < 2) + goto OUT; + + /* skip leading white space */ + while ((*src) && (src<end) && (*src==' ')) + ++src; + + /* copy string, omitting trailing white space */ + while ((*src) && (src<end)) { + *dst++ = *src; + if (*src++ != ' ') + last = dst; + } +OUT: + *last = '\0'; } /* ------------------------------------------------------------------------- */ diff --git a/cpu/mpc8xx/lcd.c b/cpu/mpc8xx/lcd.c index f7620ef2c2..dc2f554c90 100644 --- a/cpu/mpc8xx/lcd.c +++ b/cpu/mpc8xx/lcd.c @@ -1057,7 +1057,7 @@ static void lcd_enable (void) #if defined(CONFIG_LWMON) { uchar c = pic_read (0x60); #if defined(CONFIG_LCD) && defined(CONFIG_LWMON) && (CONFIG_POST & CFG_POST_SYSMON) - c |= 0x04; /* Chip Enable LCD */ + /* Enable LCD later in sysmon test, only if temperature is OK */ #else c |= 0x07; /* Power on CCFL, Enable CCFL, Chip Enable LCD */ #endif diff --git a/include/configs/IceCube.h b/include/configs/IceCube.h index 37c76c3064..38db440f43 100644 --- a/include/configs/IceCube.h +++ b/include/configs/IceCube.h @@ -89,7 +89,6 @@ #if 1 #define CONFIG_USB_OHCI #define ADD_USB_CMD CFG_CMD_USB | CFG_CMD_FAT -#define CONFIG_DOS_PARTITION #define CONFIG_USB_STORAGE #else #define ADD_USB_CMD 0 diff --git a/include/part.h b/include/part.h index 73000a7db2..5282c85217 100644 --- a/include/part.h +++ b/include/part.h @@ -37,9 +37,9 @@ typedef struct block_dev_desc { #endif unsigned long lba; /* number of blocks */ unsigned long blksz; /* block size */ - unsigned char vendor[40]; /* IDE model, SCSI Vendor */ - unsigned char product[20]; /* IDE Serial no, SCSI product */ - unsigned char revision[8]; /* firmware revision */ + unsigned char vendor [40+1]; /* IDE model, SCSI Vendor */ + unsigned char product[20+1]; /* IDE Serial no, SCSI product */ + unsigned char revision[8+1]; /* firmware revision */ unsigned long (*block_read)(int dev, unsigned long start, unsigned long blkcnt, diff --git a/post/sysmon.c b/post/sysmon.c index e28de90484..8758ccdc0a 100644 --- a/post/sysmon.c +++ b/post/sysmon.c @@ -115,10 +115,10 @@ struct sysmon_table_s static sysmon_table_t sysmon_table[] = { {"Board temperature", " C", &sysmon_lm87_sgn, NULL, sysmon_ccfl_disable, - 1, 1, -128, 127, 0xFF, 0x58, 0xD5, 0, 0x67, 0xC6, 0, 0x27}, + 1, 1, -128, 127, 0xFF, 0x58, 0xD5, 0, 0x6C, 0xC6, 0, 0x27}, {"Front temperature", " C", &sysmon_lm87, NULL, sysmon_ccfl_disable, - 1, 100, -27316, 8984, 0xFF, 0xA4, 0xFC, 0, 0xAE, 0xF1, 0, 0x29}, + 1, 100, -27316, 8984, 0xFF, 0xA4, 0xFC, 0, 0xB2, 0xF1, 0, 0x29}, {"+3.3V CPU logic", "V", &sysmon_lm87, NULL, NULL, 100, 1000, 0, 4386, 0xFF, 0xB6, 0xC9, 0, 0xB6, 0xC9, 0, 0x22}, @@ -150,8 +150,7 @@ int sysmon_init_f (void) reg |= 0x09; pic_write (0x60, reg); - for (l = sysmon_list; *l; l++) - { + for (l = sysmon_list; *l; l++) { (*l)->init(*l); } @@ -165,15 +164,13 @@ void sysmon_reloc (void) sysmon_t ** l; sysmon_table_t * t; - for (l = sysmon_list; *l; l++) - { + for (l = sysmon_list; *l; l++) { RELOC(*l); RELOC((*l)->init); RELOC((*l)->read); } - for (t = sysmon_table; t < sysmon_table + sysmon_table_size; t ++) - { + for (t = sysmon_table; t < sysmon_table + sysmon_table_size; t ++) { RELOC(t->exec_before); RELOC(t->exec_after); RELOC(t->sysmon); @@ -204,12 +201,10 @@ static char *sysmon_unit_value (sysmon_table_t *s, uint val) dec = s->unit_precision; - if (dec != 1) - { + if (dec != 1) { *p++ = '.'; } - for (dec /= 10; dec != 0; dec /= 10) - { + for (dec /= 10; dec != 0; dec /= 10) { *p++ = '0' + (frac / dec) % 10; } strcpy(p, s->unit_name); @@ -223,24 +218,21 @@ static void sysmon_lm87_init (sysmon_t * this) /* Detect LM87 chip */ if (i2c_read(this->chip, 0x40, 1, &val, 1) || (val & 0x80) != 0 || - i2c_read(this->chip, 0x3E, 1, &val, 1) || val != 0x02) - { + i2c_read(this->chip, 0x3E, 1, &val, 1) || val != 0x02) { printf("Error: LM87 not found at 0x%02X\n", this->chip); return; } /* Configure pins 5,6 as AIN */ val = 0x03; - if (i2c_write(this->chip, 0x16, 1, &val, 1)) - { + if (i2c_write(this->chip, 0x16, 1, &val, 1)) { printf("Error: can't write LM87 config register\n"); return; } /* Start monitoring */ val = 0x01; - if (i2c_write(this->chip, 0x40, 1, &val, 1)) - { + if (i2c_write(this->chip, 0x40, 1, &val, 1)) { printf("Error: can't write LM87 config register\n"); return; } @@ -267,8 +259,7 @@ static uint sysmon_i2c_read_sgn (sysmon_t * this, uint addr) static void sysmon_ccfl_disable (sysmon_table_t * this) { - if (!this->val_valid_alt) - { + if (!this->val_valid_alt) { sysmon_temp_invalid = 1; } } @@ -277,10 +268,9 @@ static void sysmon_ccfl_enable (sysmon_table_t * this) { ulong reg; - if (!sysmon_temp_invalid) - { + if (!sysmon_temp_invalid) { reg = pic_read (0x60); - reg |= 0x02; + reg |= 0x06; pic_write (0x60, reg); } } @@ -296,16 +286,13 @@ int sysmon_post_test (int flags) /* * The A/D conversion on the LM87 sensor takes 300 ms. */ - if (! conversion_done) - { + if (! conversion_done) { while (post_time_ms(gd->post_init_f_time) < 300) WATCHDOG_RESET (); conversion_done = 1; } - for (t = sysmon_table; t < sysmon_table + sysmon_table_size; t ++) - { - if (t->exec_before) - { + for (t = sysmon_table; t < sysmon_table + sysmon_table_size; t ++) { + if (t->exec_before) { t->exec_before(t); } @@ -313,13 +300,11 @@ int sysmon_post_test (int flags) t->val_valid = val >= t->val_min && val <= t->val_max; t->val_valid_alt = val >= t->val_min_alt && val <= t->val_max_alt; - if (t->exec_after) - { + if (t->exec_after) { t->exec_after(t); } - if ((!t->val_valid) || (flags & POST_MANUAL)) - { + if ((!t->val_valid) || (flags & POST_MANUAL)) { printf("%-17s = %-10s ", t->name, sysmon_unit_value(t, val)); printf("allowed range"); printf(" %-8s ..", sysmon_unit_value(t, t->val_min)); @@ -327,8 +312,7 @@ int sysmon_post_test (int flags) printf(" %s\n", t->val_valid ? "OK" : "FAIL"); } - if (!t->val_valid) - { + if (!t->val_valid) { res = -1; } } |