diff options
| author | Sean Anderson <sean.anderson@seco.com> | 2021-05-27 12:02:34 -0400 |
|---|---|---|
| committer | Han Gao <gaohan@iscas.ac.cn> | 2023-10-19 00:15:40 +0800 |
| commit | a9ee7466870cbc97155f19293edda82026aab6b7 (patch) | |
| tree | 10e01bcdf560a58b8c9aac68b643f7afdb8e56c8 | |
| parent | 8640db84b84b06c39f2e45e140c87ed8e74b80aa (diff) | |
fastboot: Fix overflow when calculating chunk size
If a chunk was larger than 4GiB, then chunk_data_sz would overflow and
blkcnt would not be calculated correctly. Upgrade it to a u64 and cast
its multiplicands as well. Also fix bytes_written while we're at it.
Signed-off-by: Sean Anderson <sean.anderson@seco.com>
Reviewed-by: Heiko Schocher <hs@denx.de>
| -rw-r--r-- | lib/image-sparse.c | 17 |
1 files changed, 9 insertions, 8 deletions
diff --git a/lib/image-sparse.c b/lib/image-sparse.c index 03606213..ee88ab1a 100644 --- a/lib/image-sparse.c +++ b/lib/image-sparse.c @@ -52,10 +52,10 @@ int write_sparse_image(struct sparse_storage *info, lbaint_t blk; lbaint_t blkcnt; lbaint_t blks; - uint32_t bytes_written = 0; + uint64_t bytes_written = 0; unsigned int chunk; unsigned int offset; - unsigned int chunk_data_sz; + uint64_t chunk_data_sz; uint32_t *fill_buf = NULL; uint32_t fill_val; sparse_header_t *sparse_header; @@ -129,8 +129,8 @@ int write_sparse_image(struct sparse_storage *info, sizeof(chunk_header_t)); } - chunk_data_sz = sparse_header->blk_sz * chunk_header->chunk_sz; - blkcnt = chunk_data_sz / info->blksz; + chunk_data_sz = ((u64)sparse_header->blk_sz) * chunk_header->chunk_sz; + blkcnt = DIV_ROUND_UP_ULL(chunk_data_sz, info->blksz); switch (chunk_header->chunk_type) { case CHUNK_TYPE_RAW: if (chunk_header->total_sz != @@ -159,7 +159,7 @@ int write_sparse_image(struct sparse_storage *info, return -1; } blk += blks; - bytes_written += blkcnt * info->blksz; + bytes_written += ((u64)blkcnt) * info->blksz; total_blocks += chunk_header->chunk_sz; data += chunk_data_sz; break; @@ -219,8 +219,9 @@ int write_sparse_image(struct sparse_storage *info, blk += blks; i += j; } - bytes_written += blkcnt * info->blksz; - total_blocks += chunk_data_sz / sparse_header->blk_sz; + bytes_written += ((u64)blkcnt) * info->blksz; + total_blocks += DIV_ROUND_UP_ULL(chunk_data_sz, + sparse_header->blk_sz); free(fill_buf); break; @@ -250,7 +251,7 @@ int write_sparse_image(struct sparse_storage *info, debug("Wrote %d blocks, expected to write %d blocks\n", total_blocks, sparse_header->total_blks); - printf("........ wrote %u bytes to '%s'\n", bytes_written, part_name); + printf("........ wrote %llu bytes to '%s'\n", bytes_written, part_name); if (total_blocks != sparse_header->total_blks) { info->mssg("sparse image write failure", response); |