mirror/u-boot-2016
1
0
Fork 0
mirror of https://git.codelinaro.org/clo/qsdk/oss/boot/u-boot-2016.git synced 2025-12-10 07:44:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

lib: fdt: add integer overflow checks in fdt header

Browse source 
these checks will usefull in finding the integer overflow
in fdt header fields.

(cherry picked from commit b6b7c1e767cd03e34fe835115d01f83d935abf3a)

Change-Id: I8469116124e4c0086885994132345df95bbf3bdc
Signed-off-by: Kathiravan T <kathirav@codeaurora.org>
This commit is contained in:
vijay kumar 2014-08-12 20:35:44 +05:30 • committed by Gerrit - the friendly Code Review server
parent 39b207217d
commit 01b8983f67
2 changed files with 15 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
lib/libfdt/fdt.c
View file

@ -14,6 +14,8 @@
#include "libfdt_internal.h" #include "libfdt_internal.h"
#define UINT_MAX (~0U)
int fdt_check_header(const void *fdt) int fdt_check_header(const void *fdt)
{ {
if (fdt_magic(fdt) == FDT_MAGIC) { if (fdt_magic(fdt) == FDT_MAGIC) {
@ -30,6 +32,18 @@ int fdt_check_header(const void *fdt)
return -FDT_ERR_BADMAGIC; return -FDT_ERR_BADMAGIC;
} }
if (fdt_off_dt_struct(fdt) > (UINT_MAX - fdt_size_dt_struct(fdt)))
return FDT_ERR_BADOFFSET;
if (fdt_off_dt_strings(fdt) > (UINT_MAX - fdt_size_dt_strings(fdt)))
return FDT_ERR_BADOFFSET;
if ((fdt_off_dt_struct(fdt) + fdt_size_dt_struct(fdt)) > fdt_totalsize(fdt))
return FDT_ERR_BADOFFSET;
if ((fdt_off_dt_strings(fdt) + fdt_size_dt_strings(fdt)) > fdt_totalsize(fdt))
return FDT_ERR_BADOFFSET;
return 0; return 0;
} }

2
lib/libfdt/fdt_rw.c
View file

@ -353,7 +353,7 @@ int fdt_del_node(void *fdt, int nodeoffset)
static void _fdt_packblocks(const char *old, char *new, static void _fdt_packblocks(const char *old, char *new,
int mem_rsv_size, int struct_size) int mem_rsv_size, int struct_size)
{ {
int mem_rsv_off, struct_off, strings_off; uint32_t mem_rsv_off, struct_off, strings_off;
mem_rsv_off = FDT_ALIGN(sizeof(struct fdt_header), 8); mem_rsv_off = FDT_ALIGN(sizeof(struct fdt_header), 8);
struct_off = mem_rsv_off + mem_rsv_size; struct_off = mem_rsv_off + mem_rsv_size;