Update of /cvsroot/blob/blob/src/lib
In directory usw-pr-cvs1:/tmp/cvs-serv16006
Modified Files:
generic_io.c
Log Message:
- bounds checking in io_read() and io_write()
- RAM pools are board specific. Remove initialization from here.
Index: generic_io.c
===================================================================
RCS file: /cvsroot/blob/blob/src/lib/generic_io.c,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -d -r1.3 -r1.4
--- generic_io.c 8 May 2002 14:02:35 -0000 1.3
+++ generic_io.c 9 May 2002 11:42:23 -0000 1.4
@@ -48,7 +48,7 @@
#define IO_MODULE_TEST 1
#define IO_DEBUG 1
-#ifdef IO_DEBUG
+#if IO_DEBUG
# define DBG( x, args... ) if ( io_dbg>x ) printf( args )
# define DBGIO( x, io ) if ( io_dbg>x ) printf( "%s: " \
"%s(%p)={ c=%p, r=%p, w=%p,\n\tp=%p, sz=%d, ch=%p,\n\tn='%s' }\n", \
@@ -85,6 +85,7 @@
/**********************************************************************
* Prototypen
*/
+static int ram_io_conf( io_driver_t * io, void *conf );
static int ram_io_read( unsigned char *dest, unsigned char *src, size_t amount, io_driver_t *io );
static int ram_io_write( unsigned char *dest, unsigned char *src, size_t amount, io_driver_t *io );
@@ -154,10 +155,15 @@
if ( !name )
return NULL;
+#if IO_DEBUG
+ for ( i=0; i<IO_MAX_DRIVER;i++) {
+ DBG( 1, "%s: #%d %p: '%s'\n", __FUNCTION__,
+ i, drivers[i], drivers[i]?io_get_name( drivers[i] ):"(NULL)" );
+ }
+#endif
+
for ( i=0; i<IO_MAX_DRIVER;i++) {
if (drivers[i]) {
- DBG( 1, "%s: #%d '%s'\n", __FUNCTION__,
- i, io_get_name( drivers[i] ) );
if ( strncmp( io_get_name( drivers[i] ), name, IO_NAME_LEN ) == 0 )
return drivers[i];
}
@@ -203,7 +209,11 @@
if ( !rd || !rd->read )
return -EINVAL;
- /* FIXME: check bounds */
+ /* check bounds */
+ if ( (io_get_size( rd ) - (size_t)src) < amount ) {
+ DBG( 1, "%s: out of bounds!\n", __FUNCTION__ );
+ return -ERANGE;
+ }
return rd->read( dest, src, amount, rd );
}
@@ -218,7 +228,11 @@
if ( !rd|| !rd->write )
return -EINVAL;
- /* FIXME: check bounds */
+ /* check bounds */
+ if ( (io_get_size( rd ) - (size_t)dest) < amount ) {
+ DBG( 1, "%s: out of bounds!\n", __FUNCTION__ );
+ return -ERANGE;
+ }
return rd->write( dest, src, amount, rd );
}
@@ -277,36 +291,8 @@
/**********************************************************************
* A simple RAM driver
+ * - io driver for RAM access
*/
-
-void init_ram_default_io( void )
-{
- int ret;
- static ram_io_t ram0, ram1;
- static io_driver_t io_ram0, io_ram1;
-
- ram0.start=0xd0000000;
- ram0.len=8*1024*1024;
- ram0.pos=0;
-
- ram1.start=0xd0800000;
- ram1.len=8*1024*1024;
- ram1.pos=0;
-
- ret = ram_io_init( &io_ram0, &ram0 );
- if ( ret ) return;
-
- ret = ram_io_init( &io_ram1, &ram1 );
- if ( ret ) return;
-
- ret = io_register( &io_ram0, "RAM0" );
- if ( ret ) return;
-
- ret = io_register( &io_ram1, "RAM1" );
- if ( ret ) return;
-}
-__initlist(init_ram_default_io, INIT_LEVEL_OTHER_STUFF + 2);
-
int ram_io_init( io_driver_t *io, ram_io_t *ram )
{
if ( !io || !ram )
@@ -322,7 +308,7 @@
return 0;
}
-int ram_io_conf( io_driver_t * io, void *conf )
+static int ram_io_conf( io_driver_t * io, void *conf )
{
ram_io_t *ram;
|