rendered paste bodydiff --git a/src/hal/drivers/mesa-hostmot2/bitfile.c b/src/hal/drivers/mesa-hostmot2/bitfile.c
index ac10300..22d046f 100644
--- a/src/hal/drivers/mesa-hostmot2/bitfile.c
+++ b/src/hal/drivers/mesa-hostmot2/bitfile.c
@@ -37,20 +37,20 @@
static int bitfile_do_small_chunk(const struct firmware *fw, bitfile_chunk_t *chunk, int *i) {
- if (*i + 2 > fw->size) {
+ if ((*i) + 2 > fw->size) {
HM2_PRINT_NO_LL("bitfile chunk extends past end of firmware\n");
return -ENODATA;
}
- chunk->size = (fw->data[*i] * 256) + fw->data[*i + 1];
+ chunk->size = (fw->data[(*i)] * 256) + fw->data[(*i) + 1];
(*i) += 2;
- if (*i + chunk->size > fw->size) {
+ if ((*i) + chunk->size > fw->size) {
HM2_PRINT_NO_LL("bitfile chunk extends past end of firmware\n");
return -ENODATA;
}
- chunk->data = &fw->data[*i];
+ chunk->data = &fw->data[(*i)];
if (chunk->data[chunk->size - 1] != '\0') {
HM2_PRINT_NO_LL("bitfile small chunk is not NULL terminated\n");
@@ -66,20 +66,20 @@ static int bitfile_do_small_chunk(const struct firmware *fw, bitfile_chunk_t *ch
static int bitfile_do_big_chunk(const struct firmware *fw, bitfile_chunk_t *chunk, int *i) {
- if (*i + 4 > fw->size) {
+ if ((*i) + 4 > fw->size) {
HM2_PRINT_NO_LL("bitfile chunk extends past end of firmware\n");
return -ENODATA;
}
- chunk->size = ((uint32_t)fw->data[*i] << 24) + ((uint32_t)fw->data[*i + 1] << 16) + ((uint32_t)fw->data[*i + 2] << 8) + fw->data[*i + 3];
+ chunk->size = ((uint32_t)fw->data[(*i)] << 24) + ((uint32_t)fw->data[(*i) + 1] << 16) + ((uint32_t)fw->data[(*i) + 2] << 8) + fw->data[(*i) + 3];
(*i) += 4;
- if (*i + chunk->size > fw->size) {
+ if ((*i) + chunk->size > fw->size) {
HM2_PRINT_NO_LL("bitfile chunk extends past end of firmware\n");
return -ENODATA;
}
- chunk->data = &fw->data[*i];
+ chunk->data = &fw->data[(*i)];
(*i) += chunk->size;
return 0;
@@ -94,6 +94,11 @@ static int bitfile_parse_and_verify_chunk(const struct firmware *fw, bitfile_t *
tag = fw->data[*i];
(*i) ++;
+ if ((*i) >= fw->size) {
+ HM2_PRINT_NO_LL("bitfile chunk '%c' size fell off the end!\n", tag);
+ return -ENODATA;
+ }
+
switch (tag) {
case 'a':
// Design name