[Bug 1001151] New: fisdir_size when combined FIS and config

[Bug 1001151] New: fisdir_size when combined FIS and config

[bugzilla-daemon]

Please do not reply to this email. Use the web interface provided at:
http://bugs.ecos.sourceware.org/show_bug.cgi?id=1001151

           Summary: fisdir_size when combined FIS and config
           Product: eCos
           Version: CVS
          Platform: All
        OS/Version: Other
            Status: UNCONFIRMED
          Severity: normal
          Priority: low
         Component: RedBoot
        AssignedTo: unassigned@bugs.ecos.sourceware.org
        ReportedBy: stano@meduna.org
                CC: ecos-bugs@ecos.sourceware.org
             Class: Advice Request


In redboot/current/src/flash.c:

do_flash_init:

        workspace_end = (unsigned char *)(workspace_end-fisdir_size);
        fis_work_block = workspace_end;


fis_update_directory:

#ifdef CYGSEM_REDBOOT_FLASH_COMBINED_FIS_AND_CONFIG
    memcpy((char *)fis_work_block+fisdir_size, config, cfg_size);
    conf_endian_fixup((char *)fis_work_block+fisdir_size);
    blk_size += cfg_size;
#endif



In the case the workspace_end is at the end of the usable memory, there is no
sufficiently large common ZLIB buffer and
CYGSEM_REDBOOT_FLASH_COMBINED_FIS_AND_CONFIG is set, the memcpy writes past the
end of the memory - either generating a fault or possibly wrapping around
overwriting whatever happens to be there.

-- 
Configure bugmail: http://bugs.ecos.sourceware.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug 1001151] fisdir_size when combined FIS and config

[bugzilla-daemon]

Please do not reply to this email. Use the web interface provided at:
http://bugs.ecos.sourceware.org/show_bug.cgi?id=1001151

--- Comment #1 from Stanislav Meduna <stano@meduna.org> 2011-02-14 22:11:39 GMT ---
OK it was also a configuration problem - the CYGNUM_REDBOOT_FLASH_CONFIG_SIZE
was too large (size of a whole block). Anyway, this problem should be caught
somewhere.

-- 
Configure bugmail: http://bugs.ecos.sourceware.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are on the CC list for the bug.

[Bug 1001151] New: fisdir_size when combined FIS and config

[bugzilla-daemon]

Please do not reply to this email. Use the web interface provided at:
http://bugs.ecos.sourceware.org/show_bug.cgi?id=1001151

           Summary: fisdir_size when combined FIS and config
           Product: eCos
           Version: CVS
          Platform: All
        OS/Version: Other
            Status: UNCONFIRMED
          Severity: normal
          Priority: low
         Component: RedBoot
        AssignedTo: unassigned@bugs.ecos.sourceware.org
        ReportedBy: stano@meduna.org
                CC: ecos-bugs@ecos.sourceware.org
             Class: Advice Request


In redboot/current/src/flash.c:

do_flash_init:

        workspace_end = (unsigned char *)(workspace_end-fisdir_size);
        fis_work_block = workspace_end;


fis_update_directory:

#ifdef CYGSEM_REDBOOT_FLASH_COMBINED_FIS_AND_CONFIG
    memcpy((char *)fis_work_block+fisdir_size, config, cfg_size);
    conf_endian_fixup((char *)fis_work_block+fisdir_size);
    blk_size += cfg_size;
#endif



In the case the workspace_end is at the end of the usable memory, there is no
sufficiently large common ZLIB buffer and
CYGSEM_REDBOOT_FLASH_COMBINED_FIS_AND_CONFIG is set, the memcpy writes past the
end of the memory - either generating a fault or possibly wrapping around
overwriting whatever happens to be there.

-- 
Configure bugmail: http://bugs.ecos.sourceware.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.