imximage: header.length of 4 is valid
authorTroy Kisky <troy.kisky@boundarydevices.com>
Mon, 21 Sep 2015 21:02:48 +0000 (14:02 -0700)
committerStefano Babic <sbabic@denx.de>
Wed, 7 Oct 2015 11:24:35 +0000 (13:24 +0200)
Signed-off-by: Troy Kisky <troy.kisky@boundarydevices.com>
tools/imximage.c

index 0da48a733d4296f521cc3cbc8b2a0513e4bf7e69..7e60bf5d3964f4f0213ee5d21e78ec6c232b76ec 100644 (file)
@@ -361,8 +361,8 @@ static void print_hdr_v2(struct imx_header *imx_hdr)
        dcd_v2_t *dcd_v2 = &hdr_v2->dcd_table;
        uint32_t size, version;
 
-       size = be16_to_cpu(dcd_v2->header.length) - 8;
-       if (size > (MAX_HW_CFG_SIZE_V2 * sizeof(dcd_addr_data_t))) {
+       size = be16_to_cpu(dcd_v2->header.length);
+       if (size > (MAX_HW_CFG_SIZE_V2 * sizeof(dcd_addr_data_t)) + 8) {
                fprintf(stderr,
                        "Error: Image corrupt DCD size %d exceed maximum %d\n",
                        (uint32_t)(size / sizeof(dcd_addr_data_t)),