diff options
| author | Rob Herring <rob.herring@calxeda.com> | 2013-03-22 11:26:21 (GMT) |
|---|---|---|
| committer | Tom Rini <trini@ti.com> | 2013-04-02 20:23:34 (GMT) |
| commit | 60d7d5a63189c9f77a190c9965861dc15482c2d0 (patch) | |
| tree | 68bf7c543f8f282142eb7a10c700b3a3d86341fb /common/env_onenand.c | |
| parent | c17b94ec5ec89c63070dd385b6c3a6645761c405 (diff) | |
| download | u-boot-fsl-qoriq-60d7d5a63189c9f77a190c9965861dc15482c2d0.tar.xz | |
env: fix potential stack overflow in environment functions
Most of the various environment functions create CONFIG_ENV_SIZE buffers on
the stack. At least on ARM and PPC which have 4KB stacks, this can overflow
the stack if we have large environment sizes. So move all the buffers off
the stack to static buffers.
Signed-off-by: Rob Herring <rob.herring@calxeda.com>
Diffstat (limited to 'common/env_onenand.c')
| -rw-r--r-- | common/env_onenand.c | 13 |
1 files changed, 7 insertions, 6 deletions
diff --git a/common/env_onenand.c b/common/env_onenand.c index faa903d..6fd5613 100644 --- a/common/env_onenand.c +++ b/common/env_onenand.c @@ -42,6 +42,8 @@ char *env_name_spec = "OneNAND"; #define ONENAND_MAX_ENV_SIZE CONFIG_ENV_SIZE #define ONENAND_ENV_SIZE(mtd) (ONENAND_MAX_ENV_SIZE - ENV_HEADER_SIZE) +static char env_buf[CONFIG_ENV_SIZE]; + DECLARE_GLOBAL_DATA_PTR; void env_relocate_spec(void) @@ -56,8 +58,7 @@ void env_relocate_spec(void) char *buf = (char *)&environment; #else loff_t env_addr = CONFIG_ENV_ADDR; - char onenand_env[ONENAND_MAX_ENV_SIZE]; - char *buf = (char *)&onenand_env[0]; + char *buf = env_buf; #endif /* ENV_IS_EMBEDDED */ #ifndef ENV_IS_EMBEDDED @@ -81,7 +82,7 @@ void env_relocate_spec(void) int saveenv(void) { - env_t env_new; + env_t *env_new = env_buf; ssize_t len; char *res; struct mtd_info *mtd = &onenand_mtd; @@ -94,13 +95,13 @@ int saveenv(void) .callback = NULL, }; - res = (char *)&env_new.data; + res = (char *)env_new->data; len = hexport_r(&env_htab, '\0', 0, &res, ENV_SIZE, 0, NULL); if (len < 0) { error("Cannot export environment: errno = %d\n", errno); return 1; } - env_new.crc = crc32(0, env_new.data, ENV_SIZE); + env_new->crc = crc32(0, env_new->data, ENV_SIZE); instr.len = CONFIG_ENV_SIZE; #ifdef CONFIG_ENV_ADDR_FLEX @@ -119,7 +120,7 @@ int saveenv(void) } if (mtd->write(mtd, env_addr, ONENAND_MAX_ENV_SIZE, &retlen, - (u_char *)&env_new)) { + (u_char *)env_new)) { printf("OneNAND: write failed at 0x%llx\n", instr.addr); return 2; } |