@@ -293,6 +293,7 @@ int wb_diff(WB_DIFF_CTX *ctx, uint8_t *patch, uint32_t len)
293293 break ;
294294 if ((memcmp (pa , (ctx -> src_b + ctx -> off_b ), BLOCK_HDR_SIZE ) == 0 )) {
295295 uintptr_t b_start ;
296+ uint8_t * pa_limit = ctx -> src_a + ctx -> size_a ;
296297 /* Identical areas of BLOCK_HDR_SIZE bytes match between the images.
297298 * initialize match_len; blk_start is the relative offset within
298299 * the src image.
@@ -302,13 +303,13 @@ int wb_diff(WB_DIFF_CTX *ctx, uint8_t *patch, uint32_t len)
302303 b_start = ctx -> off_b ;
303304 pa += BLOCK_HDR_SIZE ;
304305 ctx -> off_b += BLOCK_HDR_SIZE ;
305- while ((( uintptr_t )( pa - ctx -> src_a ) < ( uintptr_t ) ctx -> size_a ) &&
306+ while ((pa < pa_limit ) &&
306307 (ctx -> off_b < ctx -> size_b ) &&
307308 (* pa == * (ctx -> src_b + ctx -> off_b ))) {
308309 /* Extend matching block if possible, as long as the
309310 * identical sequence continues.
310311 */
311- if ((uint32_t )( pa + 1 - ctx -> src_a ) >= ctx -> size_a ) {
312+ if ((pa + 1 ) >= pa_limit ) {
312313 /* Stop matching if the source image size limit is hit. */
313314 break ;
314315 }
@@ -337,6 +338,7 @@ int wb_diff(WB_DIFF_CTX *ctx, uint8_t *patch, uint32_t len)
337338 if (!found ) {
338339 /* Try matching an earlier section in the resulting image */
339340 uintptr_t pb_end = page_start * wolfboot_sector_size ;
341+ uint8_t * pb_limit = ctx -> src_b + pb_end ;
340342 pb = ctx -> src_b ;
341343 while (((uintptr_t )(pb - ctx -> src_b ) < pb_end ) && (p_off < len )) {
342344 /* Check image boundary */
@@ -362,7 +364,7 @@ int wb_diff(WB_DIFF_CTX *ctx, uint8_t *patch, uint32_t len)
362364 blk_start = pb - ctx -> src_b ;
363365 pb += BLOCK_HDR_SIZE ;
364366 ctx -> off_b += BLOCK_HDR_SIZE ;
365- while ((( uintptr_t )( pb - ctx -> src_b ) < pb_end ) &&
367+ while ((pb < pb_limit ) &&
366368 (ctx -> off_b < ctx -> size_b ) &&
367369 (* pb == * (ctx -> src_b + ctx -> off_b ))) {
368370 /* Extend match as long as the areas have the
@@ -372,7 +374,7 @@ int wb_diff(WB_DIFF_CTX *ctx, uint8_t *patch, uint32_t len)
372374 * block size.
373375 */
374376 pb ++ ;
375- if (( uint32_t )( pb - ctx -> src_b ) >= pb_end ) {
377+ if (pb >= pb_limit ) {
376378 pb -- ;
377379 break ;
378380 }
0 commit comments