From 315c0ace7c220591a9b220ab7698e85624b430c0 Mon Sep 17 00:00:00 2001 From: Kees Cook Date: Fri, 16 Aug 2013 07:59:16 -0700 Subject: [PATCH] bootm: allow correct bounds-check of destination While nothing presently examines the destination size, it should at least be correct so that future users of sys_mapmem() will not be surprised. Without this, it might be possible to overflow memory. Signed-off-by: Kees Cook Acked-by: Simon Glass --- common/cmd_bootm.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/common/cmd_bootm.c b/common/cmd_bootm.c index 2dd264272f9..b07b0f48b20 100644 --- a/common/cmd_bootm.c +++ b/common/cmd_bootm.c @@ -368,7 +368,7 @@ static int bootm_load_os(bootm_headers_t *images, unsigned long *load_end, const char *type_name = genimg_get_type_name(os.type); - load_buf = map_sysmem(load, image_len); + load_buf = map_sysmem(load, unc_len); image_buf = map_sysmem(image_start, image_len); switch (comp) { case IH_COMP_NONE: