From 54841ab50c20d6fa6c9cc3eb826989da3a22d934 Mon Sep 17 00:00:00 2001 From: Wolfgang Denk Date: Mon, 28 Jun 2010 22:00:46 +0200 Subject: Make sure that argv[] argument pointers are not modified. The hush shell dynamically allocates (and re-allocates) memory for the argument strings in the "char *argv[]" argument vector passed to commands. Any code that modifies these pointers will cause serious corruption of the malloc data structures and crash U-Boot, so make sure the compiler can check that no such modifications are being done by changing the code into "char * const argv[]". This modification is the result of debugging a strange crash caused after adding a new command, which used the following argument processing code which has been working perfectly fine in all Unix systems since version 6 - but not so in U-Boot: int main (int argc, char **argv) { while (--argc > 0 && **++argv == '-') { /* ====> */ while (*++*argv) { switch (**argv) { case 'd': debug++; break; ... default: usage (); } } } ... } The line marked "====>" will corrupt the malloc data structures and usually cause U-Boot to crash when the next command gets executed by the shell. With the modification, the compiler will prevent this with an error: increment of read-only location '*argv' N.B.: The code above can be trivially rewritten like this: while (--argc > 0 && **++argv == '-') { char *arg = *argv; while (*++arg) { switch (*arg) { ... Signed-off-by: Wolfgang Denk Acked-by: Mike Frysinger --- board/trab/cmd_trab.c | 24 ++++++++++----------- board/trab/trab.c | 2 +- board/trab/trab_fkt.c | 58 +++++++++++++++++++++++++-------------------------- 3 files changed, 42 insertions(+), 42 deletions(-) (limited to 'board/trab') diff --git a/board/trab/cmd_trab.c b/board/trab/cmd_trab.c index 472d7d81e..6d23470f8 100644 --- a/board/trab/cmd_trab.c +++ b/board/trab/cmd_trab.c @@ -109,16 +109,16 @@ extern s32 tsc2000_contact_temp (void); extern void tsc2000_spi_init(void); /* function declarations */ -int do_dip (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[]); -int do_vcc5v (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[]); -int do_burn_in (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[]); -int do_contact_temp (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[]); -int do_burn_in_status (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[]); +int do_dip (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]); +int do_vcc5v (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]); +int do_burn_in (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]); +int do_contact_temp (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]); +int do_burn_in_status (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]); int i2c_write_multiple (uchar chip, uint addr, int alen, uchar *buffer, int len); int i2c_read_multiple (uchar chip, uint addr, int alen, uchar *buffer, int len); -int do_temp_log (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[]); +int do_temp_log (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]); /* helper functions */ static void adc_init (void); @@ -162,7 +162,7 @@ typedef struct test_function_s { test_function_t test_function[BIF_MAX]; -int do_burn_in (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[]) +int do_burn_in (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) { int i; int cycle_status; @@ -266,7 +266,7 @@ U_BOOT_CMD( ); -int do_dip (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[]) +int do_dip (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) { int i, dip; @@ -299,7 +299,7 @@ U_BOOT_CMD( ); -int do_vcc5v (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[]) +int do_vcc5v (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) { int vcc5v; @@ -327,7 +327,7 @@ U_BOOT_CMD( ); -int do_contact_temp (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[]) +int do_contact_temp (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) { int contact_temp; @@ -352,7 +352,7 @@ U_BOOT_CMD( ); -int do_burn_in_status (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[]) +int do_burn_in_status (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) { if (argc > 1) { cmd_usage(cmdtp); @@ -842,7 +842,7 @@ static int dummy(void) return (0); } -int do_temp_log (cmd_tbl_t *cmdtp, int flag, int argc, char *argv[]) +int do_temp_log (cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[]) { int contact_temp; int delay = 0; diff --git a/board/trab/trab.c b/board/trab/trab.c index 71fd22c15..12fe120ea 100644 --- a/board/trab/trab.c +++ b/board/trab/trab.c @@ -305,7 +305,7 @@ static char *key_match (ulong kbd_data) #endif /* CONFIG_PREBOOT */ /* Read Keyboard status */ -int do_kbd (cmd_tbl_t * cmdtp, int flag, int argc, char *argv[]) +int do_kbd (cmd_tbl_t * cmdtp, int flag, int argc, char * const argv[]) { ulong kbd_data = KBD_DATA; char keybd_env[KEYBD_KEY_NUM + 1]; diff --git a/board/trab/trab_fkt.c b/board/trab/trab_fkt.c index 2df9a0440..268162e53 100644 --- a/board/trab/trab_fkt.c +++ b/board/trab/trab_fkt.c @@ -115,21 +115,21 @@ int do_rotary_switch (void); int do_pressure (void); int do_v_bat (void); int do_vfd_id (void); -int do_buzzer (char **); -int do_led (char **); -int do_full_bridge (char **); -int do_dac (char **); +int do_buzzer (char * const *); +int do_led (char * const *); +int do_full_bridge (char * const *); +int do_dac (char * const *); int do_motor_contact (void); -int do_motor (char **); -int do_pwm (char **); -int do_thermo (char **); -int do_touch (char **); -int do_rs485 (char **); -int do_serial_number (char **); +int do_motor (char * const *); +int do_pwm (char * const *); +int do_thermo (char * const *); +int do_touch (char * const *); +int do_rs485 (char * const *); +int do_serial_number (char * const *); int do_crc16 (void); int do_power_switch (void); -int do_gain (char **); -int do_eeprom (char **); +int do_gain (char * const *); +int do_eeprom (char * const *); /* helper functions */ static void adc_init (void); @@ -150,8 +150,8 @@ static unsigned short updcrc(unsigned short icrc, unsigned char *icp, unsigned int icnt); #if defined(CONFIG_CMD_I2C) -static int trab_eeprom_read (char **argv); -static int trab_eeprom_write (char **argv); +static int trab_eeprom_read (char * const *argv); +static int trab_eeprom_write (char * const *argv); int i2c_write_multiple (uchar chip, uint addr, int alen, uchar *buffer, int len); int i2c_read_multiple ( uchar chip, uint addr, int alen, uchar *buffer, @@ -163,7 +163,7 @@ int i2c_read_multiple ( uchar chip, uint addr, int alen, uchar *buffer, * test. */ -int trab_fkt (int argc, char *argv[]) +int trab_fkt (int argc, char * const argv[]) { int i; @@ -585,7 +585,7 @@ int do_vfd_id (void) return 0; } -int do_buzzer (char **argv) +int do_buzzer (char * const *argv) { int counter; @@ -635,7 +635,7 @@ int do_buzzer (char **argv) } -int do_led (char **argv) +int do_led (char * const *argv) { struct s3c24x0_gpio * const gpio = s3c24x0_get_base_gpio(); @@ -690,7 +690,7 @@ int do_led (char **argv) } -int do_full_bridge (char **argv) +int do_full_bridge (char * const *argv) { struct s3c24x0_gpio * const gpio = s3c24x0_get_base_gpio(); @@ -724,7 +724,7 @@ static inline unsigned long tsc2000_to_uv (u16 val) } -int do_dac (char **argv) +int do_dac (char * const *argv) { int brightness; @@ -799,7 +799,7 @@ int do_motor_contact (void) return 0; } -int do_motor (char **argv) +int do_motor (char * const *argv) { struct s3c24x0_gpio * const gpio = s3c24x0_get_base_gpio(); @@ -824,7 +824,7 @@ static void print_identifier (void) printf ("## FKT: "); } -int do_pwm (char **argv) +int do_pwm (char * const *argv) { int counter; struct s3c24x0_gpio * const gpio = s3c24x0_get_base_gpio(); @@ -869,7 +869,7 @@ int do_pwm (char **argv) } -int do_thermo (char **argv) +int do_thermo (char * const *argv) { int channel, res; @@ -892,7 +892,7 @@ int do_thermo (char **argv) } -int do_touch (char **argv) +int do_touch (char * const *argv) { int x, y; @@ -1045,7 +1045,7 @@ static void touch_read_x_y (int *px, int *py) } -int do_rs485 (char **argv) +int do_rs485 (char * const *argv) { int timeout; char data[RS485_MAX_RECEIVE_BUF_LEN]; @@ -1110,7 +1110,7 @@ static int rs485_receive_chars (char *data, int timeout) } -int do_serial_number (char **argv) +int do_serial_number (char * const *argv) { #if defined(CONFIG_CMD_I2C) unsigned int serial_number; @@ -1249,7 +1249,7 @@ static unsigned short updcrc(unsigned short icrc, unsigned char *icp, } -int do_gain (char **argv) +int do_gain (char * const *argv) { int range; @@ -1265,7 +1265,7 @@ int do_gain (char **argv) } -int do_eeprom (char **argv) +int do_eeprom (char * const *argv) { #if defined(CONFIG_CMD_I2C) if (strcmp (argv[2], "read") == 0) { @@ -1286,7 +1286,7 @@ int do_eeprom (char **argv) } #if defined(CONFIG_CMD_I2C) -static int trab_eeprom_read (char **argv) +static int trab_eeprom_read (char * const *argv) { int i; int len; @@ -1331,7 +1331,7 @@ static int trab_eeprom_read (char **argv) return (0); } -static int trab_eeprom_write (char **argv) +static int trab_eeprom_write (char * const *argv) { int i; int len; -- cgit v1.2.3