@@ -1536,7 +1536,7 @@ static void dosfs_sflash_ftl_check(dosfs_sflash_t *sflash)
1536
1536
* the entries into the tables ...
1537
1537
*/
1538
1538
1539
- static void dosfs_sflash_ftl_collect (dosfs_sflash_t * sflash , const uint32_t * cache , uint32_t offset , uint32_t sector , uint32_t * p_data_written , uint32_t * p_data_deleted )
1539
+ static bool dosfs_sflash_ftl_collect (dosfs_sflash_t * sflash , const uint32_t * cache , uint32_t offset , uint32_t sector , uint32_t * p_data_written , uint32_t * p_data_deleted )
1540
1540
{
1541
1541
unsigned int index , free_total ;
1542
1542
uint32_t info_logical ;
@@ -1563,7 +1563,7 @@ static void dosfs_sflash_ftl_collect(dosfs_sflash_t *sflash, const uint32_t *cac
1563
1563
case DOSFS_SFLASH_INFO_TYPE_VICTIM :
1564
1564
case DOSFS_SFLASH_INFO_TYPE_ERASE :
1565
1565
case DOSFS_SFLASH_INFO_TYPE_RECLAIM :
1566
- break ;
1566
+ return false ;
1567
1567
1568
1568
case DOSFS_SFLASH_INFO_TYPE_DELETED :
1569
1569
sflash -> victim_score [sector ] += DOSFS_SFLASH_VICTIM_DELETED_INCREMENT ;
@@ -1596,10 +1596,20 @@ static void dosfs_sflash_ftl_collect(dosfs_sflash_t *sflash, const uint32_t *cac
1596
1596
break ;
1597
1597
1598
1598
case DOSFS_SFLASH_INFO_TYPE_XLATE :
1599
+ if ((cache [index ] & DOSFS_SFLASH_INFO_DATA_MASK ) >= DOSFS_SFLASH_XLATE_COUNT )
1600
+ {
1601
+ return false;
1602
+ }
1603
+
1599
1604
sflash -> xlate_table [cache [index ] & DOSFS_SFLASH_INFO_DATA_MASK ] = info_logical ;
1600
1605
break ;
1601
1606
1602
1607
case DOSFS_SFLASH_INFO_TYPE_XLATE_SECONDARY :
1608
+ if ((cache [index ] & DOSFS_SFLASH_INFO_DATA_MASK ) >= DOSFS_SFLASH_XLATE_COUNT )
1609
+ {
1610
+ return false;
1611
+ }
1612
+
1603
1613
sflash -> xlate2_table [cache [index ] & DOSFS_SFLASH_INFO_DATA_MASK ] = info_logical ;
1604
1614
break ;
1605
1615
@@ -1619,6 +1629,8 @@ static void dosfs_sflash_ftl_collect(dosfs_sflash_t *sflash, const uint32_t *cac
1619
1629
}
1620
1630
1621
1631
sflash -> alloc_free += free_total ;
1632
+
1633
+ return true;
1622
1634
}
1623
1635
1624
1636
static bool dosfs_sflash_ftl_mount (dosfs_sflash_t * sflash )
@@ -1725,7 +1737,10 @@ static bool dosfs_sflash_ftl_mount(dosfs_sflash_t *sflash)
1725
1737
sflash -> victim_sector = (cache [0 ] & DOSFS_SFLASH_INFO_DATA_MASK );
1726
1738
}
1727
1739
1728
- dosfs_sflash_ftl_collect (sflash , cache , offset , (cache [0 ] & DOSFS_SFLASH_INFO_DATA_MASK ), & data_written [0 ], & data_deleted [0 ]);
1740
+ if (!dosfs_sflash_ftl_collect (sflash , cache , offset , (cache [0 ] & DOSFS_SFLASH_INFO_DATA_MASK ), & data_written [0 ], & data_deleted [0 ]))
1741
+ {
1742
+ return false;
1743
+ }
1729
1744
break ;
1730
1745
1731
1746
case DOSFS_SFLASH_INFO_TYPE_RECLAIM :
@@ -1855,7 +1870,10 @@ static bool dosfs_sflash_ftl_mount(dosfs_sflash_t *sflash)
1855
1870
1856
1871
dosfs_sflash_nor_write (sflash , reclaim_offset , 4 , (const uint8_t * )cache ); /* RECLAIM -> ERASE */
1857
1872
1858
- dosfs_sflash_ftl_collect (sflash , cache , reclaim_offset , (cache [0 ] & DOSFS_SFLASH_INFO_DATA_MASK ), & data_written [0 ], & data_deleted [0 ]);
1873
+ if (!dosfs_sflash_ftl_collect (sflash , cache , reclaim_offset , (cache [0 ] & DOSFS_SFLASH_INFO_DATA_MASK ), & data_written [0 ], & data_deleted [0 ]))
1874
+ {
1875
+ return false;
1876
+ }
1859
1877
}
1860
1878
}
1861
1879
0 commit comments