diff options
| author | Lei Wen <leiwen@marvell.com> | 2010-09-13 22:07:27 +0800 |
|---|---|---|
| committer | Wolfgang Denk <wd@denx.de> | 2010-09-18 23:46:24 +0200 |
| commit | d2bf29e3994688ce730c8ab82bbafe6e39c229c1 (patch) | |
| tree | ab4c06ef5ad6093be7b1fe1f87c3b67cc9ade52d | |
| parent | a12555c02d716f62aa1ec4764cf1c42bfeecf07d (diff) | |
mmc: add boundary check for mmc operation
Signed-off-by: Lei Wen <leiwen@marvell.com>
| -rw-r--r-- | drivers/mmc/mmc.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/drivers/mmc/mmc.c b/drivers/mmc/mmc.c index cf4ea161b..23928c135 100644 --- a/drivers/mmc/mmc.c +++ b/drivers/mmc/mmc.c @@ -92,6 +92,11 @@ mmc_bwrite(int dev_num, ulong start, lbaint_t blkcnt, const void*src) blklen = mmc->write_bl_len; + if ((start + blkcnt) > mmc->block_dev.lba) { + printf("MMC: block number 0x%x exceeds max(0x%x)", + start + blkcnt, mmc->block_dev.lba); + return 0; + } err = mmc_set_blocklen(mmc, mmc->write_bl_len); if (err) { @@ -219,6 +224,11 @@ static ulong mmc_bread(int dev_num, ulong start, lbaint_t blkcnt, void *dst) if (!mmc) return 0; + if ((start + blkcnt) > mmc->block_dev.lba) { + printf("MMC: block number 0x%x exceeds max(0x%x)", + start + blkcnt, mmc->block_dev.lba); + return 0; + } /* We always do full block reads from the card */ err = mmc_set_blocklen(mmc, mmc->read_bl_len); |