summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorNico Huber <nico.huber@secunet.com>2012-05-21 13:59:43 +0200
committerPatrick Georgi <patrick@georgi-clan.de>2012-06-09 13:11:36 +0200
commitc43e736c0ccd26fbfea11c19d5140ea1cc30d90d (patch)
tree27f320b4d101491cd7b5529397db6fd5173505bf
parent0421dc84dfba3b4eaa045b595320d6468b3206ef (diff)
libpayload: Fix an integer overflow in USB mass storage
Change-Id: I3d618497016478ea727c520e866d27dbc3ebf9af Signed-off-by: Nico Huber <nico.huber@secunet.com> Reviewed-on: http://review.coreboot.org/1070 Reviewed-by: Mathias Krause <minipli@googlemail.com> Tested-by: build bot (Jenkins) Reviewed-by: Patrick Georgi <patrick@georgi-clan.de>
-rw-r--r--payloads/libpayload/drivers/usb/usbmsc.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/payloads/libpayload/drivers/usb/usbmsc.c b/payloads/libpayload/drivers/usb/usbmsc.c
index d39c784c30..8d5773629f 100644
--- a/payloads/libpayload/drivers/usb/usbmsc.c
+++ b/payloads/libpayload/drivers/usb/usbmsc.c
@@ -360,6 +360,9 @@ read_capacity (usbdev_t *dev)
}
printf (" %d %d-byte sectors (%d MB)\n", MSC_INST (dev)->numblocks,
MSC_INST (dev)->blocksize,
+ /* round down high block counts to avoid integer overflow */
+ MSC_INST (dev)->numblocks > 1000000
+ ? (MSC_INST (dev)->numblocks / 1000) * MSC_INST (dev)->blocksize / 1000 :
MSC_INST (dev)->numblocks * MSC_INST (dev)->blocksize / 1000 / 1000);
}