cmd: upl: fix off-by-one argc check in do_upl_read

do_upl_read() guards against missing arguments with "argc < 1", but
argc always counts argv[0] (the command name) so that condition is
never true. The function then unconditionally dereferences argv[1],
which is out of bounds when the user runs "upl read" with no address
argument and feeds garbage into hextoul()/map_sysmem().

Use "argc < 2" so the address argument is actually required.

Fixes: 264f4b0b34c ("upl: Add a command")
Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>

diff --git a/cmd/upl.c b/cmd/upl.c
index ef2183d852815dac47c58753cc9f80d22cba9c9e..be21ec258cb9fced03e218b1100548c53f76cfff 100644 (file)
--- a/cmd/upl.c
+++ b/cmd/upl.c
@@ -93,7 +93,7 @@ static int do_upl_read(struct cmd_tbl *cmdtp, int flag, int argc,
        ulong addr;
        int ret;
 
-       if (argc < 1)
+       if (argc < 2)
                return CMD_RET_USAGE;
        addr = hextoul(argv[1], NULL);