jcs.org / u-boot
"Das U-Boot" Source Tree
0
fork

Configure Feed

Select the types of activity you want to include in your feed.

gunzip: Fix len parameter in function signature

The only call site of gzwrite() is cmd/unzip.c do_gzwrite(), where
the 'len' parameter passed to gzwrite(..., len, ...) function is of
type unsigned long. This usage is correct, the 'len' parameter is
an unsigned integer, and the gzwrite() function currently supports
input data 'len' of up to 4 GiB - 1 .

The function signature of gzwrite() function in both include/gzip.h
and lib/gunzip.c does however list 'len' as signed integer, which
is not correct, and ultimatelly limits the implementation to only
2 GiB input data 'len' .

Fix this, update gzwrite() function parameter 'len' data type to
size_t consistently in include/gzip.h and lib/gunzip.c .

Furthermore, update gzwrite() function 'szwritebuf' parameter in
lib/gunzip.c from 'unsigned long' to 'size_t' to be synchronized
with include/gzip.h . Rewrite the other parameters to size_t and
off_t and propagate the change too.

Since the gzwrite() function currently surely only supports input
data size of 4 GiB - 1, add input data size check. The limitation
comes from the current use of zlib z_stream .avail_in parameter,
to which the gzwrite() function sets the entire input data size,
and which is of unsigned int type, which cannot accept any number
beyond 4 GiB - 1. This limitation will be removed in future commit.

Reported-by: Yuya Hamamachi <yuya.hamamachi.sx@renesas.com>
Signed-off-by: Marek Vasut <marek.vasut+renesas@mailbox.org>

authored by

Marek Vasut and committed by
Tom Rini 02ffe4a0 2e6b5185

+24 -22
+2 -2
cmd/unzip.c
··· 53 53 unsigned char *addr; 54 54 unsigned long length; 55 55 unsigned long writebuf = 1<<20; 56 - u64 startoffs = 0; 57 - u64 szexpected = 0; 56 + off_t startoffs = 0; 57 + size_t szexpected = 0; 58 58 59 59 if (argc < 5) 60 60 return CMD_RET_USAGE;
+5 -5
include/gzip.h
··· 58 58 * gzwrite_progress_finish called at end of loop to 59 59 * indicate success (retcode=0) or failure 60 60 */ 61 - void gzwrite_progress_init(ulong expected_size); 61 + void gzwrite_progress_init(size_t expected_size); 62 62 63 - void gzwrite_progress(int iteration, ulong bytes_written, ulong total_bytes); 63 + void gzwrite_progress(int iteration, ulong bytes_written, size_t total_bytes); 64 64 65 - void gzwrite_progress_finish(int retcode, ulong totalwritten, ulong totalsize, 65 + void gzwrite_progress_finish(int retcode, ulong totalwritten, size_t totalsize, 66 66 u32 expected_crc, u32 calculated_crc); 67 67 68 68 /** ··· 77 77 * for files under 4GiB 78 78 * Return: 0 if OK, -1 on error 79 79 */ 80 - int gzwrite(unsigned char *src, int len, struct blk_desc *dev, ulong szwritebuf, 81 - ulong startoffs, ulong szexpected); 80 + int gzwrite(unsigned char *src, size_t len, struct blk_desc *dev, 81 + size_t szwritebuf, off_t startoffs, size_t szexpected); 82 82 83 83 /** 84 84 * gzip()- Compress data into a buffer using the gzip algorithm
+17 -15
lib/gunzip.c
··· 84 84 85 85 #ifdef CONFIG_CMD_UNZIP 86 86 __weak 87 - void gzwrite_progress_init(ulong expectedsize) 87 + void gzwrite_progress_init(size_t expectedsize) 88 88 { 89 89 putc('\n'); 90 90 } ··· 92 92 __weak 93 93 void gzwrite_progress(int iteration, 94 94 ulong bytes_written, 95 - ulong total_bytes) 95 + size_t total_bytes) 96 96 { 97 97 if (0 == (iteration & 3)) 98 - printf("%lu/%lu\r", bytes_written, total_bytes); 98 + printf("%lu/%zu\r", bytes_written, total_bytes); 99 99 } 100 100 101 101 __weak 102 102 void gzwrite_progress_finish(int returnval, 103 103 ulong bytes_written, 104 - ulong total_bytes, 104 + size_t total_bytes, 105 105 u32 expected_crc, 106 106 u32 calculated_crc) 107 107 { 108 108 if (0 == returnval) { 109 - printf("\n\t%lu bytes, crc 0x%08x\n", 109 + printf("\n\t%zu bytes, crc 0x%08x\n", 110 110 total_bytes, calculated_crc); 111 111 } else { 112 - printf("\n\tuncompressed %lu of %lu\n" 112 + printf("\n\tuncompressed %lu of %zu\n" 113 113 "\tcrcs == 0x%08x/0x%08x\n", 114 114 bytes_written, total_bytes, 115 115 expected_crc, calculated_crc); 116 116 } 117 117 } 118 118 119 - int gzwrite(unsigned char *src, int len, 120 - struct blk_desc *dev, 121 - unsigned long szwritebuf, 122 - ulong startoffs, 123 - ulong szexpected) 119 + int gzwrite(unsigned char *src, size_t len, struct blk_desc *dev, 120 + size_t szwritebuf, off_t startoffs, size_t szexpected) 124 121 { 125 122 int i, flags; 126 123 z_stream s; ··· 130 127 ulong totalfilled = 0; 131 128 lbaint_t blksperbuf, outblock; 132 129 u32 expected_crc; 133 - u32 payload_size; 130 + size_t payload_size; 134 131 int iteration = 0; 135 132 133 + if (len > 0xffffffff) { 134 + log_err("Input size over 4 GiB in size not supported\n"); 135 + return -1; 136 + } 137 + 136 138 if (!szwritebuf || 137 139 (szwritebuf % dev->blksz) || 138 140 (szwritebuf < dev->blksz)) { 139 - printf("%s: size %lu not a multiple of %lu\n", 141 + printf("%s: size %zu not a multiple of %lu\n", 140 142 __func__, szwritebuf, dev->blksz); 141 143 return -1; 142 144 } ··· 182 184 if (szexpected == 0) { 183 185 szexpected = le32_to_cpu(szuncompressed); 184 186 } else if (szuncompressed != (u32)szexpected) { 185 - printf("size of %lx doesn't match trailer low bits %x\n", 187 + printf("size of %zx doesn't match trailer low bits %x\n", 186 188 szexpected, szuncompressed); 187 189 return -1; 188 190 } 189 191 if (lldiv(szexpected, dev->blksz) > (dev->lba - outblock)) { 190 - printf("%s: uncompressed size %lu exceeds device size\n", 192 + printf("%s: uncompressed size %zu exceeds device size\n", 191 193 __func__, szexpected); 192 194 return -1; 193 195 }