From bd93d8ea10ec94183fece63fe18b9ead91b8ed67 Mon Sep 17 00:00:00 2001 From: Naveen Kumar Chaudhary Date: Fri, 26 Jun 2026 09:19:18 +0530 Subject: cmd: upl: fix off-by-one argc check in do_upl_read do_upl_read() guards against missing arguments with "argc < 1", but argc always counts argv[0] (the command name) so that condition is never true. The function then unconditionally dereferences argv[1], which is out of bounds when the user runs "upl read" with no address argument and feeds garbage into hextoul()/map_sysmem(). Use "argc < 2" so the address argument is actually required. Fixes: 264f4b0b34c ("upl: Add a command") Signed-off-by: Naveen Kumar Chaudhary --- cmd/upl.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'cmd') diff --git a/cmd/upl.c b/cmd/upl.c index ef2183d8528..be21ec258cb 100644 --- a/cmd/upl.c +++ b/cmd/upl.c @@ -93,7 +93,7 @@ static int do_upl_read(struct cmd_tbl *cmdtp, int flag, int argc, ulong addr; int ret; - if (argc < 1) + if (argc < 2) return CMD_RET_USAGE; addr = hextoul(argv[1], NULL); -- cgit v1.3.1