From edac7e5a63a717ae8c2fbe29a8a1a29c61a55d78 Mon Sep 17 00:00:00 2001
From: Gabor Juhos <juhosg@openwrt.org>
Date: Mon, 26 Apr 2010 18:28:07 +0000
Subject: [PATCH] tools/firmware-utils: add size check to the mkplanexfw tool

Also pad the image to a 64K boundary.

SVN-Revision: 21174
---
 tools/firmware-utils/src/mkplanexfw.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/tools/firmware-utils/src/mkplanexfw.c b/tools/firmware-utils/src/mkplanexfw.c
index 4b32c736956..1bdccb7c026 100644
--- a/tools/firmware-utils/src/mkplanexfw.c
+++ b/tools/firmware-utils/src/mkplanexfw.c
@@ -40,6 +40,7 @@ struct board_info {
 	char		*id;
 	uint32_t	seed;
 	uint8_t		unk[2];
+	uint32_t	datalen;
 };
 
 /*
@@ -58,10 +59,12 @@ static struct board_info boards[] = {
 		.id		= "MZK-W04NU",
 		.seed		= 2,
 		.unk		= {0x04, 0x08},
+		.datalen	= 0x770000,
 	}, {
 		.id		= "MZK-W300NH",
 		.seed		= 4,
 		.unk		= {0x00, 0x00},
+		.datalen	= 0x770000,
 	}, {
 		/* terminating entry */
 	}
@@ -189,9 +192,13 @@ int main(int argc, char *argv[])
 		goto err;
 	}
 
-	buflen = (st.st_size + 3) & ~3;
-	buflen += sizeof(*hdr);
+	if (st.st_size > board->datalen) {
+		ERR("file '%s' is too big - max size: 0x%08X (exceeds %lu bytes)\n",
+		    ifname, board->datalen, st.st_size - board->datalen);
+		goto err;
+	}
 
+	buflen = board->datalen + 0x10000;
 	buf = malloc(buflen);
 	if (!buf) {
 		ERR("no memory for buffer\n");
@@ -201,7 +208,7 @@ int main(int argc, char *argv[])
 	memset(buf, 0xff, buflen);
 	hdr = (struct planex_hdr *)buf;
 
-	hdr->datalen = HOST_TO_BE32(buflen - sizeof(*hdr));
+	hdr->datalen = HOST_TO_BE32(board->datalen);
 	hdr->unk1[0] = board->unk[0];
 	hdr->unk1[1] = board->unk[1];
 
@@ -223,7 +230,7 @@ int main(int argc, char *argv[])
 	seed = HOST_TO_BE32(board->seed);
 	sha1_starts(&ctx);
 	sha1_update(&ctx, (uchar *) &seed, sizeof(seed));
-	sha1_update(&ctx, buf + sizeof(*hdr), buflen - sizeof(*hdr));
+	sha1_update(&ctx, buf + sizeof(*hdr), board->datalen);
 	sha1_finish(&ctx, hdr->sha1sum);
 
 	outfile = fopen(ofname, "w");