Erroneous declaration of ‘nbytes’ as int leads to wrong argument type for the uint ‘length’ in ‘nbytes = length’, leading to a flipped sign, and under range negative ‘linebytes’, flipped and truncated to a large integer, allowing pointer reposition over bounds, which, when used in i2c_transfer() leads to stack buffer overflow. If exploited, this can lead to denial of service – program crash, and possibly arbitrary code execution.

//generated// Erroneous Code (in ‘do_i2c_md()’) to Declare int object via Simple Object (’nbytes’) Primitive (int, while should be uint) in Codebase (cmd/i2c.c#L473) Bare-Metal leads to Wrong Type (’nbytes’) , which propagates to Wrong Type (in ’nbytes = length’) Pass Out Coerce (’length’ from ‘=’ operator, int expected) Resolved (’length’) Numeric (uint parsed from ‘i2c md 0 0 80000100’ by do_i2c_md()) Primitive (uint) Codebase (u-boot/cmd/i2c.c#L531) in Bare-Metal (0x80000100 is negative on 32 bit-platform) that results in Flipped Sign (’length’) , which propagates to Wrong Argument (in ’linebytes = (nbytes > DISP_LINE_LEN) ? DISP_LINE_LEN : nbytes’) Operator Evaluate (>) (greater-than ‘>’) Resolved (nbytes) Numeric (negative) Primitive Codebase (u-boot/cmd/i2c.c#L536) in Bare-Metal (linebytes is negative instead f 16) that results in Under Range (negative ’linebytes’ instead of 16) , which propagates to Under Range (in ’nx_i2c_read(uint len)’) Pass In Coerce (negative ’len’) (uint expected) Resolved Numeric (negative 0x80000100) Primitive Codebase (u-boot/drivers/i2c/nx_i2c.c#L472-#L473) in Bare-Metal that results in Flipped Sign (unsigned ’len’) , which propagates to Flipped Sign (in ‘i2c_transfer()’) Pass In Coerce (unsigned ’len’) (ushort expected) Resolved Numeric (uint) Primitive Codebase (u-boot/drivers/i2c/nx_i2c.c#L498-#L499) in Bare-Metal (may crash if not truncated by driver) that results in Truncated Value (large int ’len’) , which propagates to Wrong Size (in ‘data[i++] = readb(&i2c->iicds);’) Sequential Reposition (pointer) Stack Used (too large for the 16-bit buffer at hand) Codebase (u-boot/drivers/i2c/nx_i2c.c#L499) in Bare-Metal that results in Overbound Pointer (‘i’) , which propagates to Overbound Pointer (in ‘data[i++] = readb(&i2c->iicds);’) Sequential Write (object) Stack Used Codebase (u-boot/drivers/i2c/nx_i2c.c#L449) in Bare-Metal that results in Buffer Overflow (‘data[i++] ‘) , which can be exploited toward Arbitrary Code Execution (ACE) (everything could be lost) or Denial of Service (DOS) (availability loss) security failure.