From d94bf13c85c2773c8782bc7d6b4ac0190b5d489d Mon Sep 17 00:00:00 2001 From: Bin Meng Date: Sat, 22 Dec 2018 01:55:49 -0800 Subject: [PATCH] fs: cbfs: Fix out of bound access during CBFS walking through The call to file_cbfs_fill_cache() is given with the parameter 'start' pointing to the offset by the CBFS base address, but with the parameter 'size' that equals to the whole CBFS size. During CBFS walking through, it checks files one by one and after it pass over the end of the CBFS which is 4GiB boundary it tries to check files from address 0 and so on, until the overall size the codes checked hits to the given 'size'. Fix this by passing 'start' pointing to the CBFS base address. Signed-off-by: Bin Meng Reviewed-by: Simon Glass --- fs/cbfs/cbfs.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/fs/cbfs/cbfs.c b/fs/cbfs/cbfs.c index e943325297..7b2513cb24 100644 --- a/fs/cbfs/cbfs.c +++ b/fs/cbfs/cbfs.c @@ -189,8 +189,8 @@ void file_cbfs_init(uintptr_t end_of_rom) start_of_rom = (u8 *)(end_of_rom + 1 - cbfs_header.rom_size); - file_cbfs_fill_cache(start_of_rom + cbfs_header.offset, - cbfs_header.rom_size, cbfs_header.align); + file_cbfs_fill_cache(start_of_rom, cbfs_header.rom_size, + cbfs_header.align); if (file_cbfs_result == CBFS_SUCCESS) initialized = 1; } -- 2.39.5