4848 NP_ERR_CMD_INVALID = -109 ,
4949 NP_ERR_BUF_OVERFLOW = -110 ,
5050 NP_ERR_LEN_NOT_ALIGN = -111 ,
51+ NP_ERR_LEN_EXCEEDED = -112 ,
5152};
5253
5354typedef struct __attribute__((__packed__ ))
@@ -452,6 +453,13 @@ static int np_cmd_nand_write_data(np_prog_t *prog)
452453 return NP_ERR_ADDR_INVALID ;
453454 }
454455
456+ if (prog -> addr >= prog -> chip_info -> size )
457+ {
458+ ERROR_PRINT ("Write address 0x%lx is more then chip size 0x%lx\r\n" ,
459+ prog -> addr , prog -> chip_info -> size );
460+ return NP_ERR_ADDR_EXCEEDED ;
461+ }
462+
455463 if (prog -> page .offset + len > prog -> chip_info -> page_size )
456464 write_len = prog -> chip_info -> page_size - prog -> page .offset ;
457465 else
@@ -466,9 +474,6 @@ static int np_cmd_nand_write_data(np_prog_t *prog)
466474 return NP_ERR_NAND_WR ;
467475
468476 prog -> addr += prog -> chip_info -> page_size ;
469- if (prog -> addr >= prog -> chip_info -> size )
470- prog -> addr_is_valid = 0 ;
471-
472477 prog -> page .page ++ ;
473478 prog -> page .offset = 0 ;
474479 }
@@ -489,6 +494,13 @@ static int np_cmd_nand_write_data(np_prog_t *prog)
489494 prog -> bytes_ack = prog -> bytes_written ;
490495 }
491496
497+ if (prog -> bytes_written > prog -> len )
498+ {
499+ ERROR_PRINT ("Actual write data length 0x%lx is more then 0x%lx\r\n" ,
500+ prog -> bytes_written , prog -> len );
501+ return NP_ERR_LEN_EXCEEDED ;
502+ }
503+
492504 return 0 ;
493505}
494506
0 commit comments