The current implementation casts an address to a pointer. Make it more sandbox-friendly by using map_sysmem().
Convert 'addr' variable to unsigned long, as that is the return type of hextoul() and address parameter type of map_sysmem(). Signed-off-by: Marek Vasut <[email protected]> --- Cc: Alexander Graf <[email protected]> Cc: Heinrich Schuchardt <[email protected]> Cc: Ilias Apalodimas <[email protected]> Cc: Jerome Forissier <[email protected]> Cc: Mattijs Korpershoek <[email protected]> Cc: Neil Armstrong <[email protected]> Cc: Peng Fan <[email protected]> Cc: Quentin Schulz <[email protected]> Cc: Simon Glass <[email protected]> Cc: Tom Rini <[email protected]> Cc: Yuya Hamamachi <[email protected]> Cc: [email protected] --- cmd/unzip.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/cmd/unzip.c b/cmd/unzip.c index e7a3f9808b2..b265f43f2ea 100644 --- a/cmd/unzip.c +++ b/cmd/unzip.c @@ -50,7 +50,7 @@ static int do_gzwrite(struct cmd_tbl *cmdtp, int flag, { struct blk_desc *bdev; int ret; - unsigned char *addr; + unsigned long addr; unsigned long length; unsigned long writebuf = 1<<20; u64 startoffs = 0; @@ -62,7 +62,7 @@ static int do_gzwrite(struct cmd_tbl *cmdtp, int flag, if (ret < 0) return CMD_RET_FAILURE; - addr = (unsigned char *)hextoul(argv[3], NULL); + addr = hextoul(argv[3], NULL); length = hextoul(argv[4], NULL); if (5 < argc) { @@ -75,7 +75,7 @@ static int do_gzwrite(struct cmd_tbl *cmdtp, int flag, } } - ret = gzwrite(addr, length, bdev, writebuf, startoffs, szexpected); + ret = gzwrite(map_sysmem(addr, length), length, bdev, writebuf, startoffs, szexpected); return ret ? CMD_RET_FAILURE : CMD_RET_SUCCESS; } -- 2.51.0
