rcar-gen3: plat: BL2: check for integer underflow

In check_load_area() protect the length size to avoid an integer underflow. Signed-off-by: Tobias Rist <[email protected]> Signed-off-by: Yoshifumi Hosoya <[email protected]>
renesas-rcar · Mar 17, 2023 · b596f58 · b596f58
1 parent 4f597ae
commit b596f58
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/drivers/renesas/common/io/io_rcar.c b/drivers/renesas/common/io/io_rcar.c
@@ -277,7 +277,7 @@ static int32_t check_load_area(uintptr_t dst, uintptr_t len)
 
 	prot_end = prot_start + DRAM_PROTECTED_SIZE;
 
-	if (dst < dram_start || dst > dram_end - len) {
+	if (dst < dram_start || dst > dram_end - len || dram_end < len) {
 		ERROR("BL2: dst address is on the protected area.\n");
 		result = IO_FAIL;
 		goto done;
@@ -289,7 +289,7 @@ static int32_t check_load_area(uintptr_t dst, uintptr_t len)
 		result = IO_FAIL;
 	}
 
-	if (dst < prot_start && dst > prot_start - len) {
+	if ((dst < prot_start && dst > prot_start - len) || prot_start < len) {
 		ERROR("BL2: loaded data is on the protected area.\n");
 		result = IO_FAIL;
 	}