diff options
| author | Dominik Riebeling <Dominik.Riebeling@gmail.com> | 2012-06-09 22:03:43 +0200 |
|---|---|---|
| committer | Dominik Riebeling <Dominik.Riebeling@gmail.com> | 2012-06-09 22:08:54 +0200 |
| commit | 1e2c6506fbf503bace8356f90cd54a5b01a32f88 (patch) | |
| tree | d25d1a543bff1be353cf9f204b3c5edc1f393fbd | |
| parent | c4183e1d67f88da4d934c9e02ca5beb2fc0a8ec0 (diff) | |
| download | rockbox-1e2c6506fbf503bace8356f90cd54a5b01a32f88.zip rockbox-1e2c6506fbf503bace8356f90cd54a5b01a32f88.tar.gz rockbox-1e2c6506fbf503bace8356f90cd54a5b01a32f88.tar.bz2 rockbox-1e2c6506fbf503bace8356f90cd54a5b01a32f88.tar.xz | |
Fix crash in mkimxboot bootloader installation.
mkimxboot requires passing a structure which got extended with another field.
This wasn't adjusted in Rockbox Utility, causing an out of bound access to an
array, which results in a segfault.
Change-Id: I0252849ed0b41f1d8804537c053debc9b0ecd08d
| -rw-r--r-- | rbutil/mkimxboot/mkimxboot.c | 3 | ||||
| -rw-r--r-- | rbutil/rbutilqt/base/bootloaderinstallimx.cpp | 1 |
2 files changed, 4 insertions, 0 deletions
diff --git a/rbutil/mkimxboot/mkimxboot.c b/rbutil/mkimxboot/mkimxboot.c index 8806167..c33c040 100644 --- a/rbutil/mkimxboot/mkimxboot.c +++ b/rbutil/mkimxboot/mkimxboot.c @@ -331,6 +331,9 @@ enum imx_error_t mkimxboot(const char *infile, const char *bootfile, const char *outfile, struct imx_option_t opt) { /* Dump tables */ + if(opt.fw_variant > VARIANT_COUNT) { + return IMX_ERROR; + } dump_imx_dev_info("[INFO] "); /* compute MD5 sum of the file */ uint8_t file_md5sum[16]; diff --git a/rbutil/rbutilqt/base/bootloaderinstallimx.cpp b/rbutil/rbutilqt/base/bootloaderinstallimx.cpp index e25244f..c085b30 100644 --- a/rbutil/rbutilqt/base/bootloaderinstallimx.cpp +++ b/rbutil/rbutilqt/base/bootloaderinstallimx.cpp @@ -49,6 +49,7 @@ void BootloaderThreadImx::run(void) struct imx_option_t opt; opt.debug = false; opt.output = IMX_DUALBOOT; + opt.fw_variant = VARIANT_DEFAULT; m_error = mkimxboot(m_inputfile.toLocal8Bit().constData(), m_bootfile.toLocal8Bit().constData(), |