jtag/bitq: array boundary overflow
[openocd.git] / src / jtag / drivers / bitq.c
index 87e0983d16bac5bb8e33829d5056fd6e35919b0a..55dfe0aa44e9c5a8b4b501d852246ee75c0f8d32 100644 (file)
 *   GNU General Public License for more details.                          *
 *                                                                         *
 *   You should have received a copy of the GNU General Public License     *
-*   along with this program; if not, write to the                         *
-*   Free Software Foundation, Inc.,                                       *
-*   59 Temple Place - Suite 330, Boston, MA  02111-1307, USA.             *
+*   along with this program.  If not, see <http://www.gnu.org/licenses/>. *
 ***************************************************************************/
+
 #ifdef HAVE_CONFIG_H
 #include "config.h"
 #endif
@@ -25,8 +24,7 @@
 #include "bitq.h"
 #include <jtag/interface.h>
 
-
-struct bitq_interface* bitq_interface;       /* low level bit queue interface */
+struct bitq_interface *bitq_interface; /* low level bit queue interface */
 
 /* state of input queue */
 struct bitq_state {
@@ -44,29 +42,23 @@ static struct bitq_state bitq_in_state;
 static void bitq_in_proc(void)
 {
        /* loop through the queue */
-       while (bitq_in_state.cmd)
-       {
+       while (bitq_in_state.cmd) {
                /* only JTAG_SCAN command may return data */
-               if (bitq_in_state.cmd->type == JTAG_SCAN)
-               {
+               if (bitq_in_state.cmd->type == JTAG_SCAN) {
                        /* loop through the fields */
-                       while (bitq_in_state.field_idx < bitq_in_state.cmd->cmd.scan->num_fields)
-                       {
+                       while (bitq_in_state.field_idx < bitq_in_state.cmd->cmd.scan->num_fields) {
                                struct scan_field *field;
                                field = &bitq_in_state.cmd->cmd.scan->fields[bitq_in_state.field_idx];
-                               if (field->in_value)
-                               {
+                               if (field->in_value) {
                                        /* field scanning */
-                                       while (bitq_in_state.bit_pos < field->num_bits)
-                                       {
+                                       while (bitq_in_state.bit_pos < field->num_bits) {
                                                /* index of byte being scanned */
                                                int in_idx = bitq_in_state.bit_pos / 8;
                                                /* mask of next bit to be scanned */
                                                uint8_t in_mask = 1 << (bitq_in_state.bit_pos % 8);
 
                                                int tdo = bitq_interface->in();
-                                               if (tdo < 0)
-                                               {
+                                               if (tdo < 0) {
 #ifdef _DEBUG_JTAG_IO_
                                                        LOG_DEBUG("bitq in EOF");
 #endif
@@ -89,7 +81,6 @@ static void bitq_in_proc(void)
        }
 }
 
-
 static void bitq_io(int tms, int tdi, int tdo_req)
 {
        bitq_interface->out(tms, tdi, tdo_req);
@@ -98,25 +89,21 @@ static void bitq_io(int tms, int tdi, int tdo_req)
                bitq_in_proc();
 }
 
-
 static void bitq_end_state(tap_state_t state)
 {
-       if (!tap_is_state_stable(state))
-       {
+       if (!tap_is_state_stable(state)) {
                LOG_ERROR("BUG: %i is not a valid end state", state);
                exit(-1);
        }
        tap_set_end_state(state);
 }
 
-
 static void bitq_state_move(tap_state_t new_state)
 {
        int i = 0;
        uint8_t  tms_scan;
 
-       if (!tap_is_state_stable(tap_get_state()) || !tap_is_state_stable(new_state))
-       {
+       if (!tap_is_state_stable(tap_get_state()) || !tap_is_state_stable(new_state)) {
                LOG_ERROR("TAP move from or to unstable state");
                exit(-1);
        }
@@ -124,8 +111,7 @@ static void bitq_state_move(tap_state_t new_state)
        tms_scan = tap_get_tms_path(tap_get_state(), new_state);
        int tms_count = tap_get_tms_path_len(tap_get_state(), new_state);
 
-       for (i = 0; i < tms_count; i++)
-       {
+       for (i = 0; i < tms_count; i++) {
                bitq_io(tms_scan & 1, 0, 0);
                tms_scan >>= 1;
        }
@@ -133,19 +119,16 @@ static void bitq_state_move(tap_state_t new_state)
        tap_set_state(new_state);
 }
 
-
 static void bitq_path_move(struct pathmove_command *cmd)
 {
        int i;
 
-       for (i = 0; i <= cmd->num_states; i++)
-       {
+       for (i = 0; i < cmd->num_states; i++) {
                if (tap_state_transition(tap_get_state(), false) == cmd->path[i])
                        bitq_io(0, 0, 0);
                else if (tap_state_transition(tap_get_state(), true) == cmd->path[i])
                        bitq_io(1, 0, 0);
-               else
-               {
+               else {
                        LOG_ERROR("BUG: %s -> %s isn't a valid TAP transition", tap_state_name(
                                                         tap_get_state()), tap_state_name(cmd->path[i]));
                        exit(-1);
@@ -157,7 +140,6 @@ static void bitq_path_move(struct pathmove_command *cmd)
        tap_set_end_state(tap_get_state());
 }
 
-
 static void bitq_runtest(int num_cycles)
 {
        int i;
@@ -175,13 +157,12 @@ static void bitq_runtest(int num_cycles)
                bitq_state_move(tap_get_end_state());
 }
 
-
 static void bitq_scan_field(struct scan_field *field, int do_pause)
 {
        int bit_cnt;
        int tdo_req;
 
-       const uint8_tout_ptr;
+       const uint8_t *out_ptr;
        uint8_t  out_mask;
 
        if (field->in_value)
@@ -189,36 +170,29 @@ static void bitq_scan_field(struct scan_field *field, int do_pause)
        else
                tdo_req = 0;
 
-       if (field->out_value == NULL)
-       {
+       if (field->out_value == NULL) {
                /* just send zeros and request data from TDO */
                for (bit_cnt = field->num_bits; bit_cnt > 1; bit_cnt--)
                        bitq_io(0, 0, tdo_req);
 
                bitq_io(do_pause, 0, tdo_req);
-       }
-       else
-       {
+       } else {
                /* send data, and optionally request TDO */
                out_mask = 0x01;
                out_ptr  = field->out_value;
-               for (bit_cnt = field->num_bits; bit_cnt > 1; bit_cnt--)
-               {
+               for (bit_cnt = field->num_bits; bit_cnt > 1; bit_cnt--) {
                        bitq_io(0, ((*out_ptr) & out_mask) != 0, tdo_req);
-                       if (out_mask == 0x80)
-                       {
+                       if (out_mask == 0x80) {
                                out_mask = 0x01;
                                out_ptr++;
-                       }
-                       else
+                       } else
                                out_mask <<= 1;
                }
 
                bitq_io(do_pause, ((*out_ptr) & out_mask) != 0, tdo_req);
        }
 
-       if (do_pause)
-       {
+       if (do_pause) {
                bitq_io(0, 0, 0);
                if (tap_get_state() == TAP_IRSHIFT)
                        tap_set_state(TAP_IRPAUSE);
@@ -227,7 +201,6 @@ static void bitq_scan_field(struct scan_field *field, int do_pause)
        }
 }
 
-
 static void bitq_scan(struct scan_command *cmd)
 {
        int i;
@@ -243,28 +216,25 @@ static void bitq_scan(struct scan_command *cmd)
        bitq_scan_field(&cmd->fields[i], 1);
 }
 
-
 int bitq_execute_queue(void)
 {
-       struct jtag_commandcmd = jtag_command_queue; /* currently processed command */
+       struct jtag_command *cmd = jtag_command_queue; /* currently processed command */
 
        bitq_in_state.cmd = jtag_command_queue;
        bitq_in_state.field_idx = 0;
        bitq_in_state.bit_pos   = 0;
        bitq_in_state.status    = ERROR_OK;
 
-       while (cmd)
-       {
-               switch (cmd->type)
-               {
+       while (cmd) {
+               switch (cmd->type) {
                case JTAG_RESET:
 #ifdef _DEBUG_JTAG_IO_
                        LOG_DEBUG("reset trst: %i srst %i", cmd->cmd.reset->trst, cmd->cmd.reset->srst);
 #endif
-                       if ((cmd->cmd.reset->trst == 1) || (cmd->cmd.reset->srst && (jtag_get_reset_config() & RESET_SRST_PULLS_TRST)))
-                       {
+                       if ((cmd->cmd.reset->trst == 1) ||
+                                       (cmd->cmd.reset->srst &&
+                                       (jtag_get_reset_config() & RESET_SRST_PULLS_TRST)))
                                tap_set_state(TAP_RESET);
-                       }
                        bitq_interface->reset(cmd->cmd.reset->trst, cmd->cmd.reset->srst);
                        if (bitq_interface->in_rdy())
                                bitq_in_proc();
@@ -328,13 +298,11 @@ int bitq_execute_queue(void)
        bitq_interface->flush();
        bitq_in_proc();
 
-       if (bitq_in_state.cmd)
-       {
+       if (bitq_in_state.cmd) {
                LOG_ERROR("missing data from bitq interface");
                return ERROR_JTAG_QUEUE_FAILED;
        }
-       if (bitq_interface->in() >= 0)
-       {
+       if (bitq_interface->in() >= 0) {
                LOG_ERROR("extra data from bitq interface");
                return ERROR_JTAG_QUEUE_FAILED;
        }
@@ -342,7 +310,6 @@ int bitq_execute_queue(void)
        return bitq_in_state.status;
 }
 
-
 void bitq_cleanup(void)
 {
 }

Linking to existing account procedure

If you already have an account and want to add another login method you MUST first sign in with your existing account and then change URL to read https://review.openocd.org/login/?link to get to this page again but this time it'll work for linking. Thank you.

SSH host keys fingerprints

1024 SHA256:YKx8b7u5ZWdcbp7/4AeXNaqElP49m6QrwfXaqQGJAOk gerrit-code-review@openocd.zylin.com (DSA)
384 SHA256:jHIbSQa4REvwCFG4cq5LBlBLxmxSqelQPem/EXIrxjk gerrit-code-review@openocd.org (ECDSA)
521 SHA256:UAOPYkU9Fjtcao0Ul/Rrlnj/OsQvt+pgdYSZ4jOYdgs gerrit-code-review@openocd.org (ECDSA)
256 SHA256:A13M5QlnozFOvTllybRZH6vm7iSt0XLxbA48yfc2yfY gerrit-code-review@openocd.org (ECDSA)
256 SHA256:spYMBqEYoAOtK7yZBrcwE8ZpYt6b68Cfh9yEVetvbXg gerrit-code-review@openocd.org (ED25519)
+--[ED25519 256]--+
|=..              |
|+o..   .         |
|*.o   . .        |
|+B . . .         |
|Bo. = o S        |
|Oo.+ + =         |
|oB=.* = . o      |
| =+=.+   + E     |
|. .=o   . o      |
+----[SHA256]-----+
2048 SHA256:0Onrb7/PHjpo6iVZ7xQX2riKN83FJ3KGU0TvI0TaFG4 gerrit-code-review@openocd.zylin.com (RSA)