blob-cvs-commit

[Stefan E. <se...@us...>]

Update of /cvsroot/blob/blob/src/lib
In directory usw-pr-cvs1:/tmp/cvs-serv16006

Modified Files:
	generic_io.c 
Log Message:
- bounds checking in io_read() and io_write()
- RAM pools are board specific. Remove initialization from here.


Index: generic_io.c
===================================================================
RCS file: /cvsroot/blob/blob/src/lib/generic_io.c,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -d -r1.3 -r1.4
--- generic_io.c	8 May 2002 14:02:35 -0000	1.3
+++ generic_io.c	9 May 2002 11:42:23 -0000	1.4
@@ -48,7 +48,7 @@
 #define IO_MODULE_TEST 1
 #define IO_DEBUG 1
 
-#ifdef IO_DEBUG
+#if IO_DEBUG
 #	define DBG( x, args... )	if ( io_dbg>x ) printf( args )
 #	define DBGIO( x, io )		if ( io_dbg>x ) printf( "%s: " \
 			"%s(%p)={ c=%p, r=%p, w=%p,\n\tp=%p, sz=%d, ch=%p,\n\tn='%s' }\n", \
@@ -85,6 +85,7 @@
 /**********************************************************************
  * Prototypen
  */
+static int ram_io_conf( io_driver_t * io, void *conf );
 static int ram_io_read( unsigned char *dest, unsigned char *src, size_t amount, io_driver_t *io );
 static int ram_io_write( unsigned char *dest, unsigned char *src, size_t amount, io_driver_t *io );
 
@@ -154,10 +155,15 @@
 	if ( !name )
 		return NULL;
 
+#if IO_DEBUG
+	for ( i=0; i<IO_MAX_DRIVER;i++) {
+		DBG( 1, "%s: #%d %p: '%s'\n", __FUNCTION__,
+				i, drivers[i], drivers[i]?io_get_name( drivers[i] ):"(NULL)" );
+	}
+#endif
+
 	for ( i=0; i<IO_MAX_DRIVER;i++) {
 		if (drivers[i]) {
-			DBG( 1, "%s: #%d '%s'\n", __FUNCTION__,
-					i, io_get_name( drivers[i] ) );
 			if ( strncmp( io_get_name( drivers[i] ), name, IO_NAME_LEN ) == 0 )
 				return drivers[i];
 		}
@@ -203,7 +209,11 @@
 	if ( !rd || !rd->read )
 		return -EINVAL;
 
-	/* FIXME: check bounds  */
+	/* check bounds */
+	if ( (io_get_size( rd ) - (size_t)src) < amount ) {
+		DBG( 1, "%s: out of bounds!\n", __FUNCTION__ );
+		return -ERANGE;
+	}
 
 	return rd->read( dest, src, amount, rd );
 }
@@ -218,7 +228,11 @@
 	if ( !rd|| !rd->write  )
 		return -EINVAL;
 
-	/* FIXME: check bounds */
+	/* check bounds */
+	if ( (io_get_size( rd ) - (size_t)dest) < amount ) {
+		DBG( 1, "%s: out of bounds!\n", __FUNCTION__ );
+		return -ERANGE;
+	}
 
 	return rd->write( dest, src, amount, rd );
 }
@@ -277,36 +291,8 @@
 
 /**********************************************************************
  *  A simple RAM driver
+ *  - io driver for RAM access
  */
-
-void init_ram_default_io( void )
-{
-	int ret;
-	static ram_io_t		ram0, ram1;
-	static io_driver_t	io_ram0, io_ram1;
-
-	ram0.start=0xd0000000;
-	ram0.len=8*1024*1024;
-	ram0.pos=0;
-
-	ram1.start=0xd0800000;
-	ram1.len=8*1024*1024;
-	ram1.pos=0;
-
-	ret = ram_io_init( &io_ram0, &ram0 );
-	if ( ret ) return;
-
-	ret = ram_io_init( &io_ram1, &ram1 );
-	if ( ret ) return;
-
-	ret = io_register( &io_ram0, "RAM0" ); 
-	if ( ret ) return;
-
-	ret = io_register( &io_ram1, "RAM1" ); 
-	if ( ret ) return;
-}
-__initlist(init_ram_default_io, INIT_LEVEL_OTHER_STUFF + 2);
-
 int ram_io_init( io_driver_t *io, ram_io_t *ram )
 {
 	if ( !io || !ram )
@@ -322,7 +308,7 @@
 	return 0;
 }
 
-int ram_io_conf( io_driver_t * io, void *conf )
+static int ram_io_conf( io_driver_t * io, void *conf )
 {
 	ram_io_t *ram;