X-Git-Url: https://jxself.org/git/?a=blobdiff_plain;f=tools%2Flib%2Fcarlfw.c;h=79a7467ad3f5e0e0f547f5263d8215b91b1d560d;hb=e017a914b2679d669e201cc76f812b641aa7eea3;hp=44897e39ef8ee07a1c0b464a1cc7857f303bb854;hpb=f2e3ff4fb3fc8c2f1d6678014a49b048f1e3beaf;p=carl9170fw.git

diff --git a/tools/lib/carlfw.c b/tools/lib/carlfw.c
index 44897e3..79a7467 100644
--- a/tools/lib/carlfw.c
+++ b/tools/lib/carlfw.c
@@ -1,5 +1,5 @@
 /*
- * Copyright 2010, Christian Lamparter <chunkeey@googlemail.com>
+ * Copyright 2010-2011 Christian Lamparter <chunkeey@googlemail.com>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -186,10 +186,15 @@ static void *__carlfw_find_desc(struct carlfw_file *file,
 				unsigned int len,
 				uint8_t compatible_revision)
 {
-	int scan = file->len, found = 0;
+	int scan, found = 0;
 	struct carl9170fw_desc_head *tmp = NULL;
 
-	while (scan >= 0) {
+	/*
+	 * Note: the last desc also has atleast a full desc_head.
+	 * There's no reason for looking beyond that point.
+	 */
+	scan = (file->len - 1) - (sizeof(*tmp) - CARL9170FW_MAGIC_SIZE);
+	while (scan > 0) {
 		if (file->data[scan] == descid[CARL9170FW_MAGIC_SIZE - found - 1])
 			found++;
 		else
@@ -202,10 +207,13 @@ static void *__carlfw_find_desc(struct carlfw_file *file,
 	}
 
 	if (found == CARL9170FW_MAGIC_SIZE) {
+		u16 tmp_desc_len;
+
 		tmp = (void *) &file->data[scan];
+		tmp_desc_len = le16_to_cpu(tmp->length);
 
 		if (!CHECK_HDR_VERSION(tmp, compatible_revision) &&
-		    (le16_to_cpu(tmp->length) >= len))
+		    (scan + tmp_desc_len <= file->len) && (tmp_desc_len >= len))
 			return tmp;
 	}
 
@@ -409,19 +417,10 @@ struct carlfw *carlfw_load(const char *basename)
 
 	init_list_head(&fw->desc_list);
 
-	snprintf(filename, sizeof(filename), "%s.dsc", basename);
-	err = __carlfw_load(&fw->hdr, filename, "r");
-
-	snprintf(filename, sizeof(filename), "%s.fw", basename);
-	err = __carlfw_load(&fw->fw, filename, "r");
-	if (!err)
-		goto found;
-
 	err = __carlfw_load(&fw->fw, basename, "r");
 	if (err)
 		goto err_out;
 
-found:
 	if (fw->hdr.name)
 		hdr_file = &fw->hdr;
 	else