cfi_flash: Bound-check index before array access

In a while loop in cfi_flash.c the array "start" is accessed at the index
"sector" before the index variable "sector" is bounds-checked, which
might lead to accesses beyond the bounds of the array.

Swap the order of the checks in the "&&" expression, so that the
short-circuit evaluation prevents out-of-bounds array accesses.

Signed-off-by: Mario Six <mario.six@gdsys.cc>
Signed-off-by: Stefan Roese <sr@denx.de>
master
Mario Six 6 years ago committed by Stefan Roese
parent 9dbaebcf9f
commit 5701ba8289
  1. 4
      drivers/mtd/cfi_flash.c

@ -761,8 +761,8 @@ static flash_sect_t find_sector(flash_info_t *info, ulong addr)
if (info != saved_info || sector >= info->sector_count)
sector = 0;
while ((info->start[sector] < addr) &&
(sector < info->sector_count - 1))
while ((sector < info->sector_count - 1) &&
(info->start[sector] < addr))
sector++;
while ((info->start[sector] > addr) && (sector > 0))
/*

Loading…
Cancel
Save