From 17df768c1e4580f03301d18ea938d3557d441911 Mon Sep 17 00:00:00 2001 From: Benjamin Herrenschmidt Date: Wed, 11 Jan 2012 19:46:20 +0000 Subject: load_image_targphys() should enforce the max size load_image_targphys() gets passed a max size for the file, but doesn't enforce it at all. Add a check and return -1 (error) if the file is too big, without loading it. Fix the bracing style in the function while we're at it. Signed-off-by: Benjamin Herrenschmidt Signed-off-by: David Gibson Signed-off-by: Alexander Graf --- hw/loader.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/hw/loader.c b/hw/loader.c index 446b62874e..415cdce534 100644 --- a/hw/loader.c +++ b/hw/loader.c @@ -108,8 +108,12 @@ int load_image_targphys(const char *filename, int size; size = get_image_size(filename); - if (size > 0) + if (size > max_sz) { + return -1; + } + if (size > 0) { rom_add_file_fixed(filename, addr, -1); + } return size; } -- cgit v1.2.1