Bounds check on ecc correction

[yaffs2.git] / yaffs_ecc.c

diff --git a/yaffs_ecc.c b/yaffs_ecc.c
index 59f3ed9cd118cffb98371b827605f282ac79b40a..813ce6d48f8543e2db7e25b9b56d9c0430a8ae7c 100644 (file)
--- a/yaffs_ecc.c
+++ b/yaffs_ecc.c
@@ -31,7 +31,7 @@
  */
 
 const char *yaffs_ecc_c_version =
  */
 
 const char *yaffs_ecc_c_version =

-    "$Id: yaffs_ecc.c,v 1.6 2005-08-11 02:51:49 charles Exp $";
+    "$Id: yaffs_ecc.c,v 1.7 2006-09-14 22:02:46 charles Exp $";

 
 #include "yportenv.h"
 
 
 #include "yportenv.h"
 


@@ -295,7 +295,8 @@ int yaffs_ECCCorrectOther(unsigned char *data, unsigned nBytes,
        if ((cDelta | lDelta | lDeltaPrime) == 0)
                return 0; /* no error */
 
        if ((cDelta | lDelta | lDeltaPrime) == 0)
                return 0; /* no error */
 

-       if (lDelta == ~lDeltaPrime && (((cDelta ^ (cDelta >> 1)) & 0x15) == 0x15))
+       if (lDelta == ~lDeltaPrime && 
+           (((cDelta ^ (cDelta >> 1)) & 0x15) == 0x15))

        {
                /* Single bit (recoverable) error in data */
 
        {
                /* Single bit (recoverable) error in data */
 


@@ -308,6 +309,9 @@ int yaffs_ECCCorrectOther(unsigned char *data, unsigned nBytes,
                if (cDelta & 0x02)
                        bit |= 0x01;
 
                if (cDelta & 0x02)
                        bit |= 0x01;
 

+               if(lDelta >= nBytes)
+                       return -1;
+                       

                data[lDelta] ^= (1 << bit);
 
                return 1; /* corrected */
                data[lDelta] ^= (1 << bit);
 
                return 1; /* corrected */