From c96cf34c5b40e55e9c487d36e8daa0721cf34660 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliver=20St=C3=B6neberg?= Date: Mon, 16 Sep 2013 15:15:57 +0000 Subject: [PATCH] fixed unnecessary checks of unsigned variable and endless loop/array out-of-bounds access in src/mess/tools/imgtool/modules/bml3.c (nw) --- src/mess/tools/imgtool/modules/bml3.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/mess/tools/imgtool/modules/bml3.c b/src/mess/tools/imgtool/modules/bml3.c index 194935b1b80..5cf30310976 100644 --- a/src/mess/tools/imgtool/modules/bml3.c +++ b/src/mess/tools/imgtool/modules/bml3.c @@ -394,9 +394,11 @@ static imgtoolerr_t get_file_size(struct bml3_dirent *ent, imgtool_image *img, c ferr = read_granule(img, granule_list->granules[granule_list->granule_count-1], info->sector_size * (granule_list->last_granule_sectors - 1), info->sector_size, buf); if (ferr) return imgtool_floppy_error(ferr); - for (last_sector_bytes = info->sector_size - 1; last_sector_bytes >= 0; last_sector_bytes--) { + for (last_sector_bytes = info->sector_size - 1; ; last_sector_bytes--) { if (buf[last_sector_bytes] != 0) break; + if (last_sector_bytes == 0) + break; } if (buf[last_sector_bytes] != 0x1a) { last_sector_bytes++; @@ -409,7 +411,7 @@ static imgtoolerr_t get_file_size(struct bml3_dirent *ent, imgtool_image *img, c } // TODO is it valid for last_sector_bytes == 0? - if (last_sector_bytes < 0 || last_sector_bytes > info->sector_size) { + if (last_sector_bytes > info->sector_size) { return IMGTOOLERR_CORRUPTIMAGE; } *size += last_sector_bytes;