sys64738
/
blackmagic
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

remote_jtagtap: Fix memory corruption in jtagtap_tdi_tdo_seq

This commit is contained in:
Uwe Bonnes 2021-09-18 22:14:16 +02:00 committed by UweBonnes
parent a93e57e112
commit da15cc3cb7
1 changed files with 21 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

34
src/platforms/hosted/remote_jtagtap.c
View File

@ -118,8 +118,6 @@ static void jtagtap_tdi_tdo_seq(
if(!ticks || (!DI && !DO)) if(!ticks || (!DI && !DO))
return; return;
uint64_t *DIl = (uint64_t *)DI;
uint64_t *DOl = (uint64_t *)DO;
while (ticks) { while (ticks) {
int chunk; int chunk;
if (ticks < 65) if (ticks < 65)
@ -128,19 +126,26 @@ static void jtagtap_tdi_tdo_seq(
chunk = 64; chunk = 64;
} }
ticks -= chunk; ticks -= chunk;
uint64_t dil; uint8_t di[8];
if (DI) memset(di, 0, 8);
dil = *DIl++; int bytes = (chunk + 7) >> 3;
else if (DI) {
dil = 0; memcpy(&di, DI, bytes);
/* Reduce the length of DI according to the bits we're transmitting */ int remainder = chunk & 7;
if (chunk < 64) DI += bytes;
dil &= ((1LL << chunk) - 1); DI += bytes;
if (remainder) {
uint8_t rem = *DI;
rem &= (1 << remainder) - 1;
*di = rem;
}
};
/* PRIx64 differs with system. Use it explicit in the format string*/
s = snprintf((char *)construct, REMOTE_MAX_MSG_SIZE, s = snprintf((char *)construct, REMOTE_MAX_MSG_SIZE,
"!J%c%02x%" PRIx64 "%c", "!J%c%02x%" PRIx64 "%c",
(!ticks && final_tms) ? (!ticks && final_tms) ?
REMOTE_TDITDO_TMS : REMOTE_TDITDO_NOTMS, REMOTE_TDITDO_TMS : REMOTE_TDITDO_NOTMS,
chunk, dil, REMOTE_EOM); chunk, *(uint64_t*)di, REMOTE_EOM);
platform_buffer_write(construct,s); platform_buffer_write(construct,s);
s = platform_buffer_read(construct, REMOTE_MAX_MSG_SIZE); s = platform_buffer_read(construct, REMOTE_MAX_MSG_SIZE);
@ -149,8 +154,11 @@ static void jtagtap_tdi_tdo_seq(
s ? (char *)&(construct[1]) : "unknown"); s ? (char *)&(construct[1]) : "unknown");
exit(-1); exit(-1);
} }
if (DO) if (DO) {
*DOl++ = remotehston(-1, (char *)&construct[1]); uint64_t res = remotehston(-1, (char *)&construct[1]);
memcpy(DO, &res, bytes);
DO += bytes;
}
} }
} }