Mirrors_Framework/libmetal
1
0
Fork 0
mirror of https://github.com/OpenAMP/libmetal.git synced 2026-02-06 03:33:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

io: fix buffer overflow in metal_sys_io_mem_map()

Browse Source 
In metal_sys_io_mem_map() if the I/O region size
is a multiple of (1<<page_shift) will result in a
buffer overflow in the for loop.

Therefore, adjust loop termination condition to
prevent accessing an out-of-bounds page.

Signed-off-by: Iuliana Prodan <iuliana.prodan@nxp.com>
This commit is contained in:
Iuliana Prodan
2025-02-06 14:00:47 +02:00
committed by Arnaud Pouliquen
parent 465fcf018c
commit 961d0171a6
2 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
lib/system/freertos/io.c
View File

@@ -22,7 +22,7 @@ void metal_sys_io_mem_map(struct metal_io_region *io)
if (psize) {
if (psize >> io->page_shift)
psize = (size_t)1 << io->page_shift;
for (p = 0; p <= (io->size >> io->page_shift); p++) {
for (p = 0; p <= ((io->size - 1) >> io->page_shift); p++) {
metal_machine_io_mem_map(va, io->physmap[p],
psize, io->mem_flags);
va += psize;

2
lib/system/generic/io.c
View File

@@ -22,7 +22,7 @@ void metal_sys_io_mem_map(struct metal_io_region *io)
if (psize) {
if (psize >> io->page_shift)
psize = (size_t)1 << io->page_shift;
for (p = 0; p <= (io->size >> io->page_shift); p++) {
for (p = 0; p <= ((io->size - 1) >> io->page_shift); p++) {
metal_machine_io_mem_map(va, io->physmap[p],
psize, io->mem_flags);
va += psize;