[U-Boot,v2,16/23] mmc: Fix incorrect handling of 'read' & 'write' commands

Submitted by Simon Glass on Nov. 22, 2012, 7:13 p.m.

Details

Message ID 1353611587-18186-17-git-send-email-sjg@chromium.org
State Accepted, archived
Delegated to: Andy Fleming
Headers show

Commit Message

Simon Glass Nov. 22, 2012, 7:13 p.m.
From: Taylor Hutt <thutt@chromium.org>

If a malformed 'read' or 'write' command is issued, the Sandbox U-Boot
can crash because the command-handling code does no error checking on
the number of provided arguments.

This change makes the mmc 'erase', 'read' and 'write' commands only
function if the proper number of arguments are supplied.

Also puts the else assignment at the beginning fo the if() statement
to shortens the generated code.  This removes an unnecessary jump from
the generated code.

Signed-off-by: Taylor Hutt <thutt@chromium.org>
Signed-off-by: Simon Glass <sjg@chromium.org>
---
Changes in v2: None

 common/cmd_mmc.c |    9 ++++-----
 1 files changed, 4 insertions(+), 5 deletions(-)

Patch hide | download patch | download mbox

diff --git a/common/cmd_mmc.c b/common/cmd_mmc.c
index 4c19df7..7dacd51 100644
--- a/common/cmd_mmc.c
+++ b/common/cmd_mmc.c
@@ -250,14 +250,13 @@  static int do_mmcops(cmd_tbl_t *cmdtp, int flag, int argc, char * const argv[])
 		return 0;
 	}
 
-	if (strcmp(argv[1], "read") == 0)
+	state = MMC_INVALID;
+	if (argc == 5 && strcmp(argv[1], "read") == 0)
 		state = MMC_READ;
-	else if (strcmp(argv[1], "write") == 0)
+	else if (argc == 5 && strcmp(argv[1], "write") == 0)
 		state = MMC_WRITE;
-	else if (strcmp(argv[1], "erase") == 0)
+	else if (argc == 4 && strcmp(argv[1], "erase") == 0)
 		state = MMC_ERASE;
-	else
-		state = MMC_INVALID;
 
 	if (state != MMC_INVALID) {
 		struct mmc *mmc = find_mmc_device(curr_device);