Skip to content

Commit

Permalink
fix heap corruption on LP64 platforms
Browse files Browse the repository at this point in the history
Mixing unsigned long and int on LP64 platforms caused the chunksize
adjustment to be wrong for flash memory reads from "negative"
addresses. This caused runaway reads and heap corruption, because
chunksize was being adjusted to be greater than numBytes. Simplify
the computation by computing the offset within the page using a mask,
and use that to check the length against pageSize.

This is less necessary after the qXfer:memory-map:read support
was added, but it's definitely needed in 2.13, and maybe some
older GDB versions don't support qXfer:memory-map:read.
  • Loading branch information
tlyu committed Jun 6, 2022
1 parent 3c39ae8 commit 91ba436
Showing 1 changed file with 4 additions and 3 deletions.
7 changes: 4 additions & 3 deletions src/jtag2rw.cc
Original file line number Diff line number Diff line change
Expand Up @@ -151,11 +151,12 @@ uchar *jtag2::jtagRead(unsigned long addr, unsigned int numBytes)
unsigned int chunksize = numBytes;
unsigned int targetOffset = 0;

if (addr + chunksize >= pageAddr + pageSize)
offset = addr & mask;
if (offset + chunksize > pageSize) {
// Chunk would cross a page boundary, reduce it
// appropriately.
chunksize -= (addr + numBytes - (pageAddr + pageSize));
offset = addr - pageAddr;
chunksize = pageSize - offset;
}

while (numBytes > 0)
{
Expand Down

0 comments on commit 91ba436

Please sign in to comment.