From d386930fa2d12d874c7631ab0786dfde00df1606 Mon Sep 17 00:00:00 2001 From: Adam Gashlin Date: Sun, 23 Jan 2022 18:14:10 -0800 Subject: [PATCH] Avoid length overflow when fetch starts beyond ROM --- pi/controller.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/pi/controller.c b/pi/controller.c index 5ef279c..1ce9662 100644 --- a/pi/controller.c +++ b/pi/controller.c @@ -90,7 +90,9 @@ static int pi_dma_read(struct pi_controller *pi) { static void pi_rom_fetch(struct pi_controller *pi, uint32_t source, int32_t length, uint8_t *dest) { int l = length; - if (source + length > pi->rom_size) + if (source >= pi->rom_size) + l = 0; + else if (source + length > pi->rom_size) l = pi->rom_size - source; memcpy(dest, pi->rom + source, l);