[OpenOCD-devel] [PATCH]: 6c28a28 flash/nor/tcl.c: fix flash bank bounds check in 'flash fill' command handler

[<ge...@op...>]

This is an automated email from Gerrit.

Bohdan Tymkiv (bh...@cy...) just uploaded a new patch set to Gerrit, which you can find at http://openocd.zylin.com/4516

-- gerrit

commit 6c28a2866ee601f35f67019563b3d3d14b13b3db
Author: Bohdan Tymkiv <bh...@cy...>
Date:   Thu May 3 22:50:58 2018 +0300

    flash/nor/tcl.c: fix flash bank bounds check in 'flash fill' command handler
    
    Steps to reproduce ( STM32F103 'Blue Pill', 128KiB of flash ):
    > flash fillh 0x0801FFFE 00 1
    wrote 2 bytes to 0x0801fffe in 0.019088s (0.102 KiB/s)
    > flash fillw 0x0801FFFE 00 1
    Error: stm32f1x.cpu -- clearing lockup after double fault
    Error: error waiting for target flash write algorithm
    Error: error writing to flash at address 0x08000000 at offset 0x0001fffe
    
    Change-Id: I145092ec5e45bc586b3df48bf37c38c9226915c1
    Signed-off-by: Bohdan Tymkiv <bh...@cy...>

diff --git a/src/flash/nor/tcl.c b/src/flash/nor/tcl.c
index 34681db..e4980a4 100644
--- a/src/flash/nor/tcl.c
+++ b/src/flash/nor/tcl.c
@@ -502,7 +502,7 @@ COMMAND_HANDLER(handle_flash_fill_command)
 	if (count == 0)
 		return ERROR_OK;
 
-	if (address + count >= bank->base + bank->size) {
+	if (address + count * wordsize > bank->base + bank->size) {
 		LOG_ERROR("Cannot cross flash bank borders");
 		return ERROR_FAIL;
 	}

--