From 404fd12aae9a4691fa71c9b8053211c4b58ea825 Mon Sep 17 00:00:00 2001
From: Jens Arnold <amiconn@rockbox.org>
Date: Fri, 4 Feb 2005 00:58:47 +0000
Subject: MMC driver now panics on out-of-bound accesses.

git-svn-id: svn://svn.rockbox.org/rockbox/trunk@5768 a1c6a512-1295-4272-9138-f99709370657
---
 apps/debug_menu.c          |  7 ++-----
 firmware/drivers/ata_mmc.c | 18 +++++++++++++-----
 firmware/export/ata_mmc.h  |  1 +
 3 files changed, 16 insertions(+), 10 deletions(-)

diff --git a/apps/debug_menu.c b/apps/debug_menu.c
index 0637d0ce8a..a41baf6753 100644
--- a/apps/debug_menu.c
+++ b/apps/debug_menu.c
@@ -1278,7 +1278,6 @@ bool dbg_mmc_info(void)
 {
     bool done = false;
     int currval = 0;
-    unsigned long value;
     tCardInfo *card;
     unsigned char pbuf[32], pbuf2[32];
     unsigned char card_name[7];
@@ -1322,10 +1321,8 @@ bool dbg_mmc_info(void)
                          (int) mmc_extract_bits(card->cid, 0, 8),
                          (int) mmc_extract_bits(card->cid, 8, 16));
                 lcd_puts(0, 4, pbuf);
-                value = mmc_extract_bits(card->csd, 54, 12)
-                      * (SECTOR_SIZE << (mmc_extract_bits(card->csd, 78, 3)+2));
-                snprintf(pbuf, sizeof(pbuf), "Size: %ld MB",
-                         value / (1024*1024));
+                snprintf(pbuf, sizeof(pbuf), "Size: %d MB",
+                         card->numsectors * SECTOR_SIZE / (1024*1024));
                 lcd_puts(0, 5, pbuf);
             }
             else                  /* Technical details */
diff --git a/firmware/drivers/ata_mmc.c b/firmware/drivers/ata_mmc.c
index e27e693528..260418c694 100644
--- a/firmware/drivers/ata_mmc.c
+++ b/firmware/drivers/ata_mmc.c
@@ -476,6 +476,10 @@ static int initialize_card(int card_no)
     card->r2w_factor = 1 << temp;
     card->write_timeout = card->read_timeout * card->r2w_factor;
 
+    /* card size */
+    card->numsectors = mmc_extract_bits(card->csd, 54, 12)
+                      * (1 << (mmc_extract_bits(card->csd, 78, 3)+2));
+
     /* switch to full speed */
     setup_sci1(card->bitrate_register);
     
@@ -616,11 +620,10 @@ static int send_single_sector(const unsigned char *buf, int timeout)
     return ret;
 }
 
-int ata_read_sectors(
-    IF_MV2(int drive,)
-    unsigned long start,
-    int incount,
-    void* inbuf)
+int ata_read_sectors(IF_MV2(int drive,)
+                     unsigned long start,
+                     int incount,
+                     void* inbuf)
 {
     int ret = 0;
     int i;
@@ -639,6 +642,9 @@ int ata_read_sectors(
     card = &card_info[current_card];
     ret = select_card(current_card);
 #endif
+    if (start + incount > card->numsectors)
+        panicf("Reading past end of card\n");
+
     if (ret == 0)
     {
         if (incount == 1)
@@ -702,6 +708,8 @@ int ata_write_sectors(IF_MV2(int drive,)
     card = &card_info[current_card];
     ret = select_card(current_card);
 #endif
+    if (start + count > card->numsectors)
+        panicf("Writing past end of card\n");
 
     if (ret == 0)
     {
diff --git a/firmware/export/ata_mmc.h b/firmware/export/ata_mmc.h
index 3e88b0e019..957849925b 100644
--- a/firmware/export/ata_mmc.h
+++ b/firmware/export/ata_mmc.h
@@ -33,6 +33,7 @@ typedef struct
     unsigned int nsac;            /* clock cycles */
     unsigned int tsac;            /* n * 0.1 ns */
     unsigned int r2w_factor;
+    unsigned int numsectors;      /* size in sectors */
 } tCardInfo;
 
 void mmc_select_clock(int card_no);
-- 
cgit v1.2.3