[PATCH v2 03/11] boot: imagemap: correct the lookup guard rationale

[Daniel Golle]

The comment on imagemap_lookup() attributes the need for its second
guard to ulong and loff_t sharing a rank on LP64. The rank wording is
wrong: loff_t is a signed long long, which outranks ulong on ILP32, so
the subtraction in (3) stays signed there and an underflowing offset
simply fails the size comparison. It is on LP64, where the two have
the same width but different signedness, that the usual arithmetic
conversions turn the subtraction unsigned and make it wrap, letting
every range appear to fit.

State the actual reason.

Signed-off-by: Daniel Golle <daniel at makrotopia.org>
---
v2: The "same rank" wording is corrected to "same width": on ILP32
    loff_t outranks ulong and the subtraction stays signed, on LP64 the
    usual arithmetic conversions turn it unsigned and it wraps.

 boot/imagemap.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/boot/imagemap.c b/boot/imagemap.c
index b004aa1644b..0a156e010ec 100644
--- a/boot/imagemap.c
+++ b/boot/imagemap.c
@@ -72,10 +72,11 @@ void *imagemap_lookup(struct udevice *dev, loff_t img_offset, ulong size)
 		 *
 		 *  2) img_offset - r->img_offset <= r->size
 		 *     The offset into the region does not exceed the
-		 *     region size.  This guard is essential: without it,
-		 *     the subtraction in (3) wraps to a huge value on
-		 *     LP64 where ulong and loff_t have the same rank
-		 *     and the arithmetic is performed as unsigned.
+		 *     region size.  This guard is essential: on LP64,
+		 *     ulong and loff_t have the same width, so the usual
+		 *     arithmetic conversions turn the subtraction in (3)
+		 *     unsigned and it wraps, making every range appear to
+		 *     fit.
 		 *
 		 *  3) size <= r->size - (img_offset - r->img_offset)
 		 *     The requested range fits in the remaining space.
-- 
2.56.0