flash/nor/core: Fix chunk size calculation in default_flash_mem_blank_check

[openocd.git] / src / flash / nor / core.c

diff --git a/src/flash/nor/core.c b/src/flash/nor/core.c
index f05c68b823410e53251a4e758227544331f34c15..c541afcd06cccce6243f0e72438d793fb6385ad6 100644 (file)
--- a/src/flash/nor/core.c
+++ b/src/flash/nor/core.c
@@ -68,6 +68,11 @@ int flash_driver_protect(struct flash_bank *bank, int set, int first, int last)
        /* force "set" to 0/1 */
        set = !!set;
 
+       if (bank->driver->protect == NULL) {
+               LOG_ERROR("Flash protection is not supported.");
+               return ERROR_FLASH_OPER_UNSUPPORTED;
+       }
+
        /* DANGER!
         *
         * We must not use any cached information about protection state!!!!
@@ -188,9 +193,17 @@ void flash_free_all_banks(void)
                else
                        LOG_WARNING("Flash driver of %s does not support free_driver_priv()", bank->name);
 
+               /* For 'virtual' flash driver bank->sectors and bank->prot_blocks pointers are copied from
+                * master flash_bank structure. They point to memory locations allocated by master flash driver
+                * so master driver is responsible for releasing them.
+                * Avoid UB caused by double-free memory corruption if flash bank is 'virtual'. */
+
+               if (strcmp(bank->driver->name, "virtual") != 0) {
+                       free(bank->sectors);
+                       free(bank->prot_blocks);
+               }
+
                free(bank->name);
-               free(bank->sectors);
-               free(bank->prot_blocks);
                free(bank);
                bank = next;
        }
@@ -309,8 +322,8 @@ static int default_flash_mem_blank_check(struct flash_bank *bank)
                for (j = 0; j < bank->sectors[i].size; j += buffer_size) {
                        uint32_t chunk;
                        chunk = buffer_size;
-                       if (chunk > (j - bank->sectors[i].size))
-                               chunk = (j - bank->sectors[i].size);
+                       if (chunk > (bank->sectors[i].size - j))
+                               chunk = (bank->sectors[i].size - j);
 
                        retval = target_read_memory(target,
                                        bank->base + bank->sectors[i].offset + j,