Skip to content

Commit 5217759

Browse files
authored
Fix overflow issue in write_memory_progbuf (#714)
If range's upper bound was equal to 2^64 or the range was wrapping around 0 (which is perfectly legal), writes were not performed due to riscv_addr_t overflow.
1 parent 793def2 commit 5217759

File tree

1 file changed

+5
-7
lines changed

1 file changed

+5
-7
lines changed

src/target/riscv/riscv-013.c

Lines changed: 5 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -3834,10 +3834,10 @@ static int write_memory_progbuf(struct target *target, target_addr_t address,
38343834
riscv_program_write(&program);
38353835

38363836
riscv_addr_t cur_addr = address;
3837-
riscv_addr_t fin_addr = address + (count * size);
3837+
riscv_addr_t distance = (riscv_addr_t)count * size;
38383838
bool setup_needed = true;
3839-
LOG_DEBUG("writing until final address 0x%016" PRIx64, fin_addr);
3840-
while (cur_addr < fin_addr) {
3839+
LOG_DEBUG("writing until final address 0x%016" PRIx64, cur_addr + distance);
3840+
while (cur_addr - address < distance) {
38413841
LOG_DEBUG("transferring burst starting at address 0x%016" PRIx64,
38423842
cur_addr);
38433843

@@ -3849,14 +3849,12 @@ static int write_memory_progbuf(struct target *target, target_addr_t address,
38493849
goto error;
38503850

38513851
/* To write another word, we put it in S1 and execute the program. */
3852-
unsigned start = (cur_addr - address) / size;
3853-
for (unsigned i = start; i < count; ++i) {
3854-
unsigned offset = size*i;
3852+
for (riscv_addr_t offset = cur_addr - address; offset < distance; offset += size) {
38553853
const uint8_t *t_buffer = buffer + offset;
38563854

38573855
uint64_t value = buf_get_u64(t_buffer, 0, 8 * size);
38583856

3859-
log_memory_access(address + offset, value, size, false);
3857+
log_memory_access(cur_addr, value, size, false);
38603858
cur_addr += size;
38613859

38623860
if (setup_needed) {

0 commit comments

Comments
 (0)