diff options
author | Rafaël Carré <rafael.carre@gmail.com> | 2010-05-16 10:24:31 +0000 |
---|---|---|
committer | Rafaël Carré <rafael.carre@gmail.com> | 2010-05-16 10:24:31 +0000 |
commit | c785722fecb9f653d70d37af3d5e47a7a5442def (patch) | |
tree | 2dcdbdb5421a1bf85156ebdb64f48390468d6c77 /firmware/target/arm/as3525 | |
parent | f95a982dcf17c477898648ee32fa1bba8f2f4d92 (diff) | |
download | rockbox-c785722fecb9f653d70d37af3d5e47a7a5442def.tar.gz rockbox-c785722fecb9f653d70d37af3d5e47a7a5442def.zip |
as3525: make sure we don't use a negative number of sectors
Better be safe than sorry, don't try to read/write outside our storage,
because we might overwrite the OF on the internal storage
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@26077 a1c6a512-1295-4272-9138-f99709370657
Diffstat (limited to 'firmware/target/arm/as3525')
-rw-r--r-- | firmware/target/arm/as3525/sd-as3525.c | 7 | ||||
-rw-r--r-- | firmware/target/arm/as3525/sd-as3525v2.c | 11 |
2 files changed, 14 insertions, 4 deletions
diff --git a/firmware/target/arm/as3525/sd-as3525.c b/firmware/target/arm/as3525/sd-as3525.c index dea4a578cf..5cffced743 100644 --- a/firmware/target/arm/as3525/sd-as3525.c +++ b/firmware/target/arm/as3525/sd-as3525.c | |||
@@ -682,11 +682,16 @@ static int sd_transfer_sectors(IF_MD2(int drive,) unsigned long start, | |||
682 | goto sd_transfer_error; | 682 | goto sd_transfer_error; |
683 | } | 683 | } |
684 | 684 | ||
685 | if((start+count) > card_info[drive].numblocks) | 685 | if(count < 0) /* XXX: why is it signed ? */ |
686 | { | 686 | { |
687 | ret = -20; | 687 | ret = -20; |
688 | goto sd_transfer_error; | 688 | goto sd_transfer_error; |
689 | } | 689 | } |
690 | if((start+count) > card_info[drive].numblocks) | ||
691 | { | ||
692 | ret = -21; | ||
693 | goto sd_transfer_error; | ||
694 | } | ||
690 | 695 | ||
691 | /* skip SanDisk OF */ | 696 | /* skip SanDisk OF */ |
692 | if (drive == INTERNAL_AS3525) | 697 | if (drive == INTERNAL_AS3525) |
diff --git a/firmware/target/arm/as3525/sd-as3525v2.c b/firmware/target/arm/as3525/sd-as3525v2.c index 37d72217b3..b61f4dd25f 100644 --- a/firmware/target/arm/as3525/sd-as3525v2.c +++ b/firmware/target/arm/as3525/sd-as3525v2.c | |||
@@ -809,11 +809,16 @@ static int sd_transfer_sectors(IF_MD2(int drive,) unsigned long start, | |||
809 | } | 809 | } |
810 | } | 810 | } |
811 | 811 | ||
812 | if((start+count) > card_info[drive].numblocks) | 812 | if(count < 0) /* XXX: why is it signed ? */ |
813 | { | 813 | { |
814 | ret = -18; | 814 | ret = -18; |
815 | goto sd_transfer_error; | 815 | goto sd_transfer_error; |
816 | } | 816 | } |
817 | if((start+count) > card_info[drive].numblocks) | ||
818 | { | ||
819 | ret = -19; | ||
820 | goto sd_transfer_error; | ||
821 | } | ||
817 | 822 | ||
818 | /* skip SanDisk OF */ | 823 | /* skip SanDisk OF */ |
819 | if (drive == INTERNAL_AS3525) | 824 | if (drive == INTERNAL_AS3525) |
@@ -821,7 +826,7 @@ static int sd_transfer_sectors(IF_MD2(int drive,) unsigned long start, | |||
821 | 826 | ||
822 | /* CMD7 w/rca: Select card to put it in TRAN state */ | 827 | /* CMD7 w/rca: Select card to put it in TRAN state */ |
823 | if(!send_cmd(drive, SD_SELECT_CARD, card_info[drive].rca, MCI_NO_RESP, NULL)) | 828 | if(!send_cmd(drive, SD_SELECT_CARD, card_info[drive].rca, MCI_NO_RESP, NULL)) |
824 | return -19; | 829 | return -20; |
825 | 830 | ||
826 | last_disk_activity = current_tick; | 831 | last_disk_activity = current_tick; |
827 | dma_retain(); | 832 | dma_retain(); |
@@ -911,7 +916,7 @@ static int sd_transfer_sectors(IF_MD2(int drive,) unsigned long start, | |||
911 | /* CMD lines are separate, not common, so we need to actively deselect */ | 916 | /* CMD lines are separate, not common, so we need to actively deselect */ |
912 | /* CMD7 w/rca =0 : deselects card & puts it in STBY state */ | 917 | /* CMD7 w/rca =0 : deselects card & puts it in STBY state */ |
913 | if(!send_cmd(drive, SD_DESELECT_CARD, 0, MCI_NO_RESP, NULL)) | 918 | if(!send_cmd(drive, SD_DESELECT_CARD, 0, MCI_NO_RESP, NULL)) |
914 | return -20; | 919 | return -21; |
915 | 920 | ||
916 | #ifndef BOOTLOADER | 921 | #ifndef BOOTLOADER |
917 | sd_enable(false); | 922 | sd_enable(false); |