mtd: seama: fix image data handling

[openwrt/svn-archive/archive.git] / package / system / mtd / src / seama.c

diff --git a/package/system/mtd/src/seama.c b/package/system/mtd/src/seama.c
index 42b1e88e080f2bf6d8875ff7f6e14470ae4dc4db..e3c0e4d51ec9487c2457d1bdc0d98cf8e39c014a 100644 (file)
--- a/package/system/mtd/src/seama.c
+++ b/package/system/mtd/src/seama.c
@@ -51,34 +51,30 @@ ssize_t pread(int fd, void *buf, size_t count, off_t offset);
 ssize_t pwrite(int fd, const void *buf, size_t count, off_t offset);
 
 int
-seama_fix_md5(char *buf, size_t len)
+seama_fix_md5(struct seama_entity_header *shdr, int fd, size_t data_offset, size_t data_size)
 {
-       struct seama_entity_header *shdr = (struct seama_entity_header *) buf;
-       char *data;
-       size_t msize;
-       size_t isize;
+       char *buf;
+       ssize_t res;
        MD5_CTX ctx;
        unsigned char digest[16];
        int i;
+       int err = 0;
 
-       if (len < sizeof(struct seama_entity_header))
-               return -1;
-
-       isize = ntohl(shdr->size);
-       msize = ntohs(shdr->metasize);
-       if (isize == 0) {
-               /* the image contains no checksum */
-               return -1;
+       buf = malloc(data_size);
+       if (!buf) {
+               err = -ENOMEM;
+               goto err_out;
        }
 
-       len -= sizeof(struct seama_entity_header) + msize;
-       if (isize > len)
-               isize = len;
-
-       data = buf + sizeof(struct seama_entity_header) + msize;
+       res = pread(fd, buf, data_size, data_offset);
+       if (res != data_size) {
+               perror("pread");
+               err = -EIO;
+               goto err_free;
+       }
 
        MD5_Init(&ctx);
-       MD5_Update(&ctx, data, isize);
+       MD5_Update(&ctx, buf, data_size);
        MD5_Final(digest, &ctx);
 
        if (!memcmp(digest, shdr->md5, sizeof(digest))) {
@@ -88,7 +84,7 @@ seama_fix_md5(char *buf, size_t len)
        }
 
        if (quiet < 2) {
-               fprintf(stderr, "new size:%u, new MD5: ", isize);
+               fprintf(stderr, "new size:%u, new MD5: ", data_size);
                for (i = 0; i < sizeof(digest); i++)
                        fprintf(stderr, "%02x", digest[i]);
 
@@ -96,12 +92,15 @@ seama_fix_md5(char *buf, size_t len)
        }
 
        /* update the size in the image */
-       shdr->size = htonl(isize);
+       shdr->size = htonl(data_size);
 
        /* update the checksum in the image */
        memcpy(shdr->md5, digest, sizeof(digest));
 
-       return 0;
+err_free:
+       free(buf);
+err_out:
+       return err;
 }
 
 int
@@ -109,9 +108,10 @@ mtd_fixseama(const char *mtd, size_t offset)
 {
        int fd;
        char *first_block;
-       char *buf;
        ssize_t res;
        size_t block_offset;
+       size_t data_offset;
+       size_t data_size;
        struct seama_entity_header *shdr;
 
        if (quiet < 2)
@@ -145,25 +145,20 @@ mtd_fixseama(const char *mtd, size_t offset)
                exit(1);
        }
 
-       shdr = (struct seama_entity_header *)first_block;
+       shdr = (struct seama_entity_header *)(first_block + offset);
        if (shdr->magic != htonl(SEAMA_MAGIC)) {
                fprintf(stderr, "No SEAMA header found\n");
                return -1;
-       }
-
-       buf = malloc(mtdsize);
-       if (!buf) {
-               perror("malloc");
-               exit(1);
-       }
-
-       res = pread(fd, buf, mtdsize, block_offset);
-       if (res != mtdsize) {
-               perror("pread");
+       } else if (!ntohl(shdr->size)) {
+               fprintf(stderr, "Seama entity with empty image\n");
                exit(1);
        }
 
-       if (seama_fix_md5(buf, mtdsize))
+       data_offset = offset + sizeof(struct seama_entity_header) + ntohs(shdr->metasize);
+       data_size = mtdsize - data_offset;
+       if (data_size > ntohl(shdr->size))
+               data_size = ntohl(shdr->size);
+       if (seama_fix_md5(shdr, fd, data_offset, data_size))
                goto out;
 
        if (mtd_erase_block(fd, block_offset)) {
@@ -175,7 +170,7 @@ mtd_fixseama(const char *mtd, size_t offset)
        if (quiet < 2)
                fprintf(stderr, "Rewriting block at 0x%x\n", block_offset);
 
-       if (pwrite(fd, buf, erasesize, block_offset) != erasesize) {
+       if (pwrite(fd, first_block, erasesize, block_offset) != erasesize) {
                fprintf(stderr, "Error writing block (%s)\n", strerror(errno));
                exit(1);
        }