From: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
Date: Fri, 26 Jun 2026 03:49:18 +0000 (+0530)
Subject: cmd: upl: fix off-by-one argc check in do_upl_read
X-Git-Url: http://git.ipfire.org/gitweb/?a=commitdiff_plain;h=bd93d8ea10ec94183fece63fe18b9ead91b8ed67;p=thirdparty%2Fu-boot.git

cmd: upl: fix off-by-one argc check in do_upl_read

do_upl_read() guards against missing arguments with "argc < 1", but
argc always counts argv[0] (the command name) so that condition is
never true. The function then unconditionally dereferences argv[1],
which is out of bounds when the user runs "upl read" with no address
argument and feeds garbage into hextoul()/map_sysmem().

Use "argc < 2" so the address argument is actually required.

Fixes: 264f4b0b34c ("upl: Add a command")
Signed-off-by: Naveen Kumar Chaudhary <naveen.osdev@gmail.com>
---

diff --git a/cmd/upl.c b/cmd/upl.c
index ef2183d8528..be21ec258cb 100644
--- a/cmd/upl.c
+++ b/cmd/upl.c
@@ -93,7 +93,7 @@ static int do_upl_read(struct cmd_tbl *cmdtp, int flag, int argc,
 	ulong addr;
 	int ret;
 
-	if (argc < 1)
+	if (argc < 2)
 		return CMD_RET_USAGE;
 	addr = hextoul(argv[1], NULL);