Commit 0c7209be authored by Cédric Le Goater's avatar Cédric Le Goater Committed by Peter Maydell
Browse files

aspeed: check for negative values returned by blk_getlength() 



write_boot_rom() does not check for negative values. This is more a
problem for coverity than the actual code as the size of the flash
device is checked when the m25p80 object is created. If there is
anything wrong with the backing file, we should not even reach that
path.

Signed-off-by: default avatarCédric Le Goater <clg@kaod.org>
Message-id: 1486648058-520-2-git-send-email-clg@kaod.org
Reviewed-by: default avatarPeter Maydell <peter.maydell@linaro.org>
Signed-off-by: default avatarPeter Maydell <peter.maydell@linaro.org>
parent 14efdb5c

hw/arm/aspeed.c

+12 −2
Original line number Diff line number Diff line
@@ -113,9 +113,19 @@ static void write_boot_rom(DriveInfo *dinfo, hwaddr addr, size_t rom_size, 
{

    BlockBackend *blk = blk_by_legacy_dinfo(dinfo);

    uint8_t *storage;

    int64_t size;



    if (rom_size > blk_getlength(blk)) {

        rom_size = blk_getlength(blk);

    /* The block backend size should have already been 'validated' by

     * the creation of the m25p80 object.

     */

    size = blk_getlength(blk);

    if (size <= 0) {

        error_setg(errp, "failed to get flash size");

        return;

    }



    if (rom_size > size) {

        rom_size = size;

    }



    storage = g_new0(uint8_t, rom_size);