[coreboot] New patch to review for coreboot: b2d5bd2 libpayload: Fix an integer overflow in USB mass storage

Nico Huber (nico.huber@secunet.com) gerrit at coreboot.org
Thu May 31 15:41:28 CEST 2012


Nico Huber (nico.huber at secunet.com) just uploaded a new patch set to gerrit, which you can find at http://review.coreboot.org/1070

-gerrit

commit b2d5bd239402dd8410fdab99fcee678e24ab9308
Author: Nico Huber <nico.huber at secunet.com>
Date:   Mon May 21 13:59:43 2012 +0200

    libpayload: Fix an integer overflow in USB mass storage
    
    Change-Id: I3d618497016478ea727c520e866d27dbc3ebf9af
    Signed-off-by: Nico Huber <nico.huber at secunet.com>
---
 payloads/libpayload/drivers/usb/usbmsc.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/payloads/libpayload/drivers/usb/usbmsc.c b/payloads/libpayload/drivers/usb/usbmsc.c
index f90acb1..e19b2a6 100644
--- a/payloads/libpayload/drivers/usb/usbmsc.c
+++ b/payloads/libpayload/drivers/usb/usbmsc.c
@@ -361,6 +361,9 @@ read_capacity (usbdev_t *dev)
 	}
 	printf ("  %d %d-byte sectors (%d MB)\n", MSC_INST (dev)->numblocks,
 		MSC_INST (dev)->blocksize,
+		/* round down high block counts to avoid integer overflow */
+		MSC_INST (dev)->numblocks > 1000000
+			? (MSC_INST (dev)->numblocks / 1000) * MSC_INST (dev)->blocksize / 1000 :
 		MSC_INST (dev)->numblocks * MSC_INST (dev)->blocksize / 1000 / 1000);
 }
 




More information about the coreboot mailing list