[flashrom-gerrit] Change in ...flashrom[master]: dediprog: Bail out on unsupported, long transfers

[Nico Huber (Code Review)]

Hello Carl-Daniel Hailfinger, ron minnich, David Hendricks,

I'd like you to do a code review. Please visit

https://review.coreboot.org/c/flashrom/+/33614

to review the following change.

Change subject: dediprog: Bail out on unsupported, long transfers
......................................................................

dediprog: Bail out on unsupported, long transfers

Change-Id: I7b16701597909c015f98199e73ebb7d923f2b072
Signed-off-by: Nico Huber 
---
M dediprog.c
1 file changed, 9 insertions(+), 1 deletion(-)

git pull ssh://review.coreboot.org:29418/flashrom refs/changes/14/33614/1

diff --git a/dediprog.c b/dediprog.c
index 8552a3c..8029b64 100644
--- a/dediprog.c
+++ b/dediprog.c
@@ -362,7 +362,15 @@

static int prepare_rw_cmd(
    	struct flashctx *const flash, uint8_t *data_packet, unsigned int count,
-		uint8_t dedi_spi_cmd, unsigned int *value, unsigned int *idx, unsigned int start, int is_read) {
+		uint8_t dedi_spi_cmd, unsigned int *value, unsigned int *idx, unsigned int start, int is_read)
+{
+	if (count >= 1 << 16) {
+		msg_perr("%s: Unsupported transfer length of %u blocks! "
+			 "Please report a bug at [e-mail]\n",
+			 __func__, count);
+		return 1;
+	}
+
    /* First 5 bytes are common in both generations. */
    data_packet[0] = count & 0xff;
    data_packet[1] = (count >> 8) & 0xff;