Fix out of range address when trying to read invalid address

diff --git a/mtcr_ul/mtcr_ul.c b/mtcr_ul/mtcr_ul.c
index 51b36d7ee03afb19d1afb59daed585a627e79840..cef82f29387a6d2ec441963b79e55afdfc2f59e4 100644 (file)
--- a/mtcr_ul/mtcr_ul.c
+++ b/mtcr_ul/mtcr_ul.c
@@ -456,6 +456,10 @@ int mtcr_mmap(struct pcicr_context *mf, const char *name, off_t off, int ioctl_n
 int mtcr_pcicr_mread4(mfile *mf, unsigned int offset, u_int32_t *value)
 {
     struct pcicr_context *ctx = mf->ctx;
+    if (offset >= MTCR_MAP_SIZE) {
+        errno = EINVAL;
+        return 0;
+    }
     if (ctx->need_flush) {
         mtcr_connectx_flush(ctx->ptr);
         ctx->need_flush = 0;
@@ -468,6 +472,10 @@ int mtcr_pcicr_mwrite4(mfile *mf, unsigned int offset, u_int32_t value)
 {
     struct pcicr_context *ctx = mf->ctx;
 
+    if (offset >= MTCR_MAP_SIZE) {
+        errno = EINVAL;
+        return 0;
+    }
     *((u_int32_t *)((char *)ctx->ptr + offset)) = __cpu_to_be32(value);
     ctx->need_flush = ctx->connectx_flush;
     return 4;

diff --git a/small_utils/mcra.c b/small_utils/mcra.c
index 7297f55f8cd0aebdd5f7dd59f811086b83cd1b0f..d330a73931018c7f97197f47850c9d077e7ca445 100644 (file)
--- a/small_utils/mcra.c
+++ b/small_utils/mcra.c
@@ -369,7 +369,9 @@ int main(int argc, char *argv[])
 
             val = MERGE(tmp_val, val, bit_offs, bit_size);
         }
-        rc = mwrite4(mf, addr, val);
+        if(mwrite4(mf, addr, val) != 4) {
+            goto access_error;
+        }
     }
     goto success;