During testing of qemu-riscv32 with a 2GiB memory configuration,
tftp always fails with a error message:
Load address: 0x84000000
Loading: #
TFTP error: trying to overwrite reserved memory...
It turns out the result of 'tftp_load_addr + tftp_load_size' just
overflows (0x100000000) and the test logic in store_block() fails.
Fix this by adjusting the end address to ULONG_MAX when overflow
is detected.
Fixes: a156c47e39ad ("tftp: prevent overwriting reserved memory")
Signed-off-by: Bin Meng <bmeng...@gmail.com>
---
net/tftp.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/net/tftp.c b/net/tftp.c
index 5a69bca..1e3c18a 100644
--- a/net/tftp.c
+++ b/net/tftp.c
@@ -171,8 +171,13 @@ static inline int store_block(int block, uchar *src,
unsigned int len)
void *ptr;
#ifdef CONFIG_LMB
+ ulong end_addr = tftp_load_addr + tftp_load_size;
+
+ if (!end_addr)
+ end_addr = ULONG_MAX;
+
if (store_addr < tftp_load_addr ||
- store_addr + len > tftp_load_addr + tftp_load_size) {
+ store_addr + len > end_addr) {
puts("\nTFTP error: ");
puts("trying to overwrite reserved memory...\n");
return -1;
--
2.7.4
_______________________________________________
U-Boot mailing list
U-Boot@lists.denx.de
https://lists.denx.de/listinfo/u-boot
