devs/foxbox
1
0
Fork 0
forked from len0rd/rockbox
Code Pull requests Activity

MMC driver now panics on out-of-bound accesses.

Browse source 
git-svn-id: svn://svn.rockbox.org/rockbox/trunk@5768 a1c6a512-1295-4272-9138-f99709370657
This commit is contained in:
Jens Arnold 2005-02-04 00:58:47 +00:00
parent dd924a522d
commit 404fd12aae
3 changed files with 16 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

7
apps/debug_menu.c
View file

@ -1278,7 +1278,6 @@ bool dbg_mmc_info(void)
{ {
bool done = false; bool done = false;
int currval = 0; int currval = 0;
unsigned long value;
tCardInfo *card; tCardInfo *card;
unsigned char pbuf[32], pbuf2[32]; unsigned char pbuf[32], pbuf2[32];
unsigned char card_name[7]; unsigned char card_name[7];
@ -1322,10 +1321,8 @@ bool dbg_mmc_info(void)
(int) mmc_extract_bits(card->cid, 0, 8), (int) mmc_extract_bits(card->cid, 0, 8),
(int) mmc_extract_bits(card->cid, 8, 16)); (int) mmc_extract_bits(card->cid, 8, 16));
lcd_puts(0, 4, pbuf); lcd_puts(0, 4, pbuf);
value = mmc_extract_bits(card->csd, 54, 12) snprintf(pbuf, sizeof(pbuf), "Size: %d MB",
* (SECTOR_SIZE << (mmc_extract_bits(card->csd, 78, 3)+2)); card->numsectors * SECTOR_SIZE / (1024*1024));
snprintf(pbuf, sizeof(pbuf), "Size: %ld MB",
value / (1024*1024));
lcd_puts(0, 5, pbuf); lcd_puts(0, 5, pbuf);
} }
else /* Technical details */ else /* Technical details */

18
firmware/drivers/ata_mmc.c
View file

@ -476,6 +476,10 @@ static int initialize_card(int card_no)
card->r2w_factor = 1 << temp; card->r2w_factor = 1 << temp;
card->write_timeout = card->read_timeout * card->r2w_factor; card->write_timeout = card->read_timeout * card->r2w_factor;
/* card size */
card->numsectors = mmc_extract_bits(card->csd, 54, 12)
* (1 << (mmc_extract_bits(card->csd, 78, 3)+2));
/* switch to full speed */ /* switch to full speed */
setup_sci1(card->bitrate_register); setup_sci1(card->bitrate_register);
@ -616,11 +620,10 @@ static int send_single_sector(const unsigned char *buf, int timeout)
return ret; return ret;
} }
int ata_read_sectors( int ata_read_sectors(IF_MV2(int drive,)
IF_MV2(int drive,) unsigned long start,
unsigned long start, int incount,
int incount, void* inbuf)
void* inbuf)
{ {
int ret = 0; int ret = 0;
int i; int i;
@ -639,6 +642,9 @@ int ata_read_sectors(
card = &card_info[current_card]; card = &card_info[current_card];
ret = select_card(current_card); ret = select_card(current_card);
#endif #endif
if (start + incount > card->numsectors)
panicf("Reading past end of card\n");
if (ret == 0) if (ret == 0)
{ {
if (incount == 1) if (incount == 1)
@ -702,6 +708,8 @@ int ata_write_sectors(IF_MV2(int drive,)
card = &card_info[current_card]; card = &card_info[current_card];
ret = select_card(current_card); ret = select_card(current_card);
#endif #endif
if (start + count > card->numsectors)
panicf("Writing past end of card\n");
if (ret == 0) if (ret == 0)
{ {

1
firmware/export/ata_mmc.h
View file

@ -33,6 +33,7 @@ typedef struct
unsigned int nsac; /* clock cycles */ unsigned int nsac; /* clock cycles */
unsigned int tsac; /* n * 0.1 ns */ unsigned int tsac; /* n * 0.1 ns */
unsigned int r2w_factor; unsigned int r2w_factor;
unsigned int numsectors; /* size in sectors */
} tCardInfo; } tCardInfo;
void mmc_select_clock(int card_no); void mmc_select_clock(int card_no);