2 files changed, 14 insertions, 4 deletions

diff --git a/firmware/target/arm/as3525/sd-as3525.c b/firmware/target/arm/as3525/sd-as3525.c
index dea4a578cf..5cffced743 100644
--- a/firmware/target/arm/as3525/sd-as3525.c
+++ b/firmware/target/arm/as3525/sd-as3525.c
@@ -682,11 +682,16 @@ static int sd_transfer_sectors(IF_MD2(int drive,) unsigned long start,
             goto sd_transfer_error;
     }
 
-    if((start+count) > card_info[drive].numblocks)
+    if(count < 0) /* XXX: why is it signed ? */
     {
         ret = -20;
         goto sd_transfer_error;
     }
+    if((start+count) > card_info[drive].numblocks)
+    {
+        ret = -21;
+        goto sd_transfer_error;
+    }
 
     /* skip SanDisk OF */
     if (drive == INTERNAL_AS3525)
diff --git a/firmware/target/arm/as3525/sd-as3525v2.c b/firmware/target/arm/as3525/sd-as3525v2.c
index 37d72217b3..b61f4dd25f 100644
--- a/firmware/target/arm/as3525/sd-as3525v2.c
+++ b/firmware/target/arm/as3525/sd-as3525v2.c
@@ -809,11 +809,16 @@ static int sd_transfer_sectors(IF_MD2(int drive,) unsigned long start,
         }
     }
 
-    if((start+count) > card_info[drive].numblocks)
+    if(count < 0) /* XXX: why is it signed ? */
     {
         ret = -18;
         goto sd_transfer_error;
     }
+    if((start+count) > card_info[drive].numblocks)
+    {
+        ret = -19;
+        goto sd_transfer_error;
+    }
 
     /* skip SanDisk OF */
     if (drive == INTERNAL_AS3525)
@@ -821,7 +826,7 @@ static int sd_transfer_sectors(IF_MD2(int drive,) unsigned long start,
 
     /*  CMD7 w/rca: Select card to put it in TRAN state */
     if(!send_cmd(drive, SD_SELECT_CARD, card_info[drive].rca, MCI_NO_RESP, NULL))
-        return -19;
+        return -20;
 
     last_disk_activity = current_tick;
     dma_retain();
@@ -911,7 +916,7 @@ static int sd_transfer_sectors(IF_MD2(int drive,) unsigned long start,
     /* CMD lines are separate, not common, so we need to actively deselect */
     /*  CMD7 w/rca =0 : deselects card & puts it in STBY state */
     if(!send_cmd(drive, SD_DESELECT_CARD, 0, MCI_NO_RESP, NULL))
-        return -20;
+        return -21;
 
 #ifndef BOOTLOADER
     sd_enable(false);