projects
/
carl9170fw.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
kconfig: rename depends_list to comment_option_list
[carl9170fw.git]
/
tools
/
lib
/
carlfw.c
diff --git
a/tools/lib/carlfw.c
b/tools/lib/carlfw.c
index 533abbca7c3e3c6412b421cd507ec412f3083343..79a7467ad3f5e0e0f547f5263d8215b91b1d560d 100644
(file)
--- a/
tools/lib/carlfw.c
+++ b/
tools/lib/carlfw.c
@@
-1,5
+1,5
@@
/*
/*
- * Copyright 2010
,
Christian Lamparter <chunkeey@googlemail.com>
+ * Copyright 2010
-2011
Christian Lamparter <chunkeey@googlemail.com>
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
@@
-186,10
+186,15
@@
static void *__carlfw_find_desc(struct carlfw_file *file,
unsigned int len,
uint8_t compatible_revision)
{
unsigned int len,
uint8_t compatible_revision)
{
- int scan
= file->len
, found = 0;
+ int scan, found = 0;
struct carl9170fw_desc_head *tmp = NULL;
struct carl9170fw_desc_head *tmp = NULL;
- while (scan >= 0) {
+ /*
+ * Note: the last desc also has atleast a full desc_head.
+ * There's no reason for looking beyond that point.
+ */
+ scan = (file->len - 1) - (sizeof(*tmp) - CARL9170FW_MAGIC_SIZE);
+ while (scan > 0) {
if (file->data[scan] == descid[CARL9170FW_MAGIC_SIZE - found - 1])
found++;
else
if (file->data[scan] == descid[CARL9170FW_MAGIC_SIZE - found - 1])
found++;
else
@@
-202,10
+207,13
@@
static void *__carlfw_find_desc(struct carlfw_file *file,
}
if (found == CARL9170FW_MAGIC_SIZE) {
}
if (found == CARL9170FW_MAGIC_SIZE) {
+ u16 tmp_desc_len;
+
tmp = (void *) &file->data[scan];
tmp = (void *) &file->data[scan];
+ tmp_desc_len = le16_to_cpu(tmp->length);
if (!CHECK_HDR_VERSION(tmp, compatible_revision) &&
if (!CHECK_HDR_VERSION(tmp, compatible_revision) &&
- (
le16_to_cpu(tmp->length)
>= len))
+ (
scan + tmp_desc_len <= file->len) && (tmp_desc_len
>= len))
return tmp;
}
return tmp;
}