Skip to content
Commit c1335e2c authored by Vignesh Raghavendra's avatar Vignesh Raghavendra Committed by Tom Rini
Browse files

spl: ymodem: Fix buffer overflow during Image copy



ymodem_read_fit() driver will end copying up to BUF_SIZE boundary even
when requested size of copy operation is less than that.
For example, if offset = 0, size = 1440B, ymodem_read_fit() ends up
copying 2KB from offset = 0, to destination buffer addr

This causes data corruption when malloc'd buffer is passed during UART
boot since commit 03f1f78a ("spl: fit: Prefer a malloc()'d buffer
for loading images")

With this, UART boot works again on K3 (AM654, J7, AM64) family of
devices.

Fixes: 03f1f78a ("spl: fit: Prefer a malloc()'d buffer for loading images")
Signed-off-by: default avatarVignesh Raghavendra <vigneshr@ti.com>
parent cd59d44c
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment