diff options
| author | Naveen Kumar Chaudhary <[email protected]> | 2026-06-26 09:19:18 +0530 |
|---|---|---|
| committer | Tom Rini <[email protected]> | 2026-07-10 15:52:36 -0600 |
| commit | bd93d8ea10ec94183fece63fe18b9ead91b8ed67 (patch) | |
| tree | 15f467ffbe1514ddef309ee2df54268e93f0a936 | |
| parent | b81e716b263479e7e2194f9a2df3c04c83307545 (diff) | |
cmd: upl: fix off-by-one argc check in do_upl_read
do_upl_read() guards against missing arguments with "argc < 1", but
argc always counts argv[0] (the command name) so that condition is
never true. The function then unconditionally dereferences argv[1],
which is out of bounds when the user runs "upl read" with no address
argument and feeds garbage into hextoul()/map_sysmem().
Use "argc < 2" so the address argument is actually required.
Fixes: 264f4b0b34c ("upl: Add a command")
Signed-off-by: Naveen Kumar Chaudhary <[email protected]>
| -rw-r--r-- | cmd/upl.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/cmd/upl.c b/cmd/upl.c index ef2183d8528..be21ec258cb 100644 --- a/cmd/upl.c +++ b/cmd/upl.c @@ -93,7 +93,7 @@ static int do_upl_read(struct cmd_tbl *cmdtp, int flag, int argc, ulong addr; int ret; - if (argc < 1) + if (argc < 2) return CMD_RET_USAGE; addr = hextoul(argv[1], NULL); |