2 files changed, 14 insertions, 5 deletions

diff --git a/firmware/drivers/ata_mmc.c b/firmware/drivers/ata_mmc.c
index e27e693528..260418c694 100644
--- a/firmware/drivers/ata_mmc.c
+++ b/firmware/drivers/ata_mmc.c
@@ -476,6 +476,10 @@ static int initialize_card(int card_no)
     card->r2w_factor = 1 << temp;
     card->write_timeout = card->read_timeout * card->r2w_factor;
 
+    /* card size */
+    card->numsectors = mmc_extract_bits(card->csd, 54, 12)
+                      * (1 << (mmc_extract_bits(card->csd, 78, 3)+2));
+
     /* switch to full speed */
     setup_sci1(card->bitrate_register);
     
@@ -616,11 +620,10 @@ static int send_single_sector(const unsigned char *buf, int timeout)
     return ret;
 }
 
-int ata_read_sectors(
-    IF_MV2(int drive,)
-    unsigned long start,
-    int incount,
-    void* inbuf)
+int ata_read_sectors(IF_MV2(int drive,)
+                     unsigned long start,
+                     int incount,
+                     void* inbuf)
 {
     int ret = 0;
     int i;
@@ -639,6 +642,9 @@ int ata_read_sectors(
     card = &card_info[current_card];
     ret = select_card(current_card);
 #endif
+    if (start + incount > card->numsectors)
+        panicf("Reading past end of card\n");
+
     if (ret == 0)
     {
         if (incount == 1)
@@ -702,6 +708,8 @@ int ata_write_sectors(IF_MV2(int drive,)
     card = &card_info[current_card];
     ret = select_card(current_card);
 #endif
+    if (start + count > card->numsectors)
+        panicf("Writing past end of card\n");
 
     if (ret == 0)
     {
diff --git a/firmware/export/ata_mmc.h b/firmware/export/ata_mmc.h
index 3e88b0e019..957849925b 100644
--- a/firmware/export/ata_mmc.h
+++ b/firmware/export/ata_mmc.h
@@ -33,6 +33,7 @@ typedef struct
     unsigned int nsac;            /* clock cycles */
     unsigned int tsac;            /* n * 0.1 ns */
     unsigned int r2w_factor;
+    unsigned int numsectors;      /* size in sectors */
 } tCardInfo;
 
 void mmc_select_clock(int card_no);