X-Git-Url: https://git.librecmc.org/?a=blobdiff_plain;f=common%2Fcmd_sf.c;h=5ac1d0c4c1ef4ef9cc34b30b3e056b2a76744beb;hb=fa651cce4f89f6d33f1ea301a6f1f781758c7dfd;hp=9c76464a9a84a72862d97e4d1235f57785cb1e7b;hpb=5c877b1ae0a4219ed6bd8d32cf3f7106b81ecb3b;p=oweals%2Fu-boot.git

diff --git a/common/cmd_sf.c b/common/cmd_sf.c
index 9c76464a9a..5ac1d0c4c1 100644
--- a/common/cmd_sf.c
+++ b/common/cmd_sf.c
@@ -211,6 +211,13 @@ static int do_spi_flash_read_write(int argc, char * const argv[])
 	if (*argv[3] == 0 || *endp != 0)
 		return -1;
 
+	/* Consistency checking */
+	if (offset + len > flash->size) {
+		printf("ERROR: attempting %s past flash size (%#x)\n",
+			argv[0], flash->size);
+		return 1;
+	}
+
 	buf = map_physmem(addr, len, MAP_WRBACK);
 	if (!buf) {
 		puts("Failed to map physical memory\n");
@@ -252,6 +259,13 @@ static int do_spi_flash_erase(int argc, char * const argv[])
 	if (ret != 1)
 		return -1;
 
+	/* Consistency checking */
+	if (offset + len > flash->size) {
+		printf("ERROR: attempting %s past flash size (%#x)\n",
+			argv[0], flash->size);
+		return 1;
+	}
+
 	ret = spi_flash_erase(flash, offset, len);
 	if (ret) {
 		printf("SPI flash %s failed\n", argv[0]);