Nico Huber would like Carl-Daniel Hailfinger, ron minnich and David Hendricks to review this change.

View Change

dediprog: Bail out on unsupported, long transfers

Change-Id: I7b16701597909c015f98199e73ebb7d923f2b072
Signed-off-by: Nico Huber <nico.h@gmx.de>
---
M dediprog.c
1 file changed, 9 insertions(+), 1 deletion(-)

git pull ssh://review.coreboot.org:29418/flashrom refs/changes/14/33614/1

diff --git a/dediprog.c b/dediprog.c
index 8552a3c..8029b64 100644
--- a/dediprog.c
+++ b/dediprog.c
@@ -362,7 +362,15 @@
 
 static int prepare_rw_cmd(
 		struct flashctx *const flash, uint8_t *data_packet, unsigned int count,
-		uint8_t dedi_spi_cmd, unsigned int *value, unsigned int *idx, unsigned int start, int is_read) {
+		uint8_t dedi_spi_cmd, unsigned int *value, unsigned int *idx, unsigned int start, int is_read)
+{
+	if (count >= 1 << 16) {
+		msg_perr("%s: Unsupported transfer length of %u blocks! "
+			 "Please report a bug at flashrom@flashrom.org\n",
+			 __func__, count);
+		return 1;
+	}
+
 	/* First 5 bytes are common in both generations. */
 	data_packet[0] = count & 0xff;
 	data_packet[1] = (count >> 8) & 0xff;

To view, visit change 33614. To unsubscribe, or for help writing mail filters, visit settings.