mirror/u-boot-2016
1
0
Fork 0
mirror of https://git.codelinaro.org/clo/qsdk/oss/boot/u-boot-2016.git synced 2025-12-10 07:44:53 +01:00
Code Issues Projects Releases Packages Wiki Activity Actions

Merge "lib: fdt: add integer overflow checks"

Browse source
This commit is contained in:
Linux Build Service Account 2021-09-07 04:38:07 -07:00 • committed by Gerrit - the friendly Code Review server
commit 3612e8c572
1 changed files with 24 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

29
lib/libfdt/fdt_rw.c
View file

@ -14,6 +14,8 @@
#include "libfdt_internal.h"
#define UINT_MAX (~0U)
static int _fdt_blocks_misordered(const void *fdt,
int mem_rsv_size, int struct_size)
{
@ -374,20 +376,31 @@ static void _fdt_packblocks(const char *old, char *new,
int fdt_open_into(const void *fdt, void *buf, int bufsize)
{
int err;
int mem_rsv_size, struct_size;
int newsize;
int err = -1;
uint32_t mem_rsv_size;
int struct_size;
uint32_t newsize;
const char *fdtstart = fdt;
const char *fdtend = fdtstart + fdt_totalsize(fdt);
const char *fdtend = NULL;
char *tmp;
if (fdtstart + fdt_totalsize(fdt) < fdtstart) {
return err;
}
fdtend = fdtstart + fdt_totalsize(fdt);
FDT_CHECK_HEADER(fdt);
if ((fdt_num_mem_rsv(fdt)+1) > (UINT_MAX / sizeof(struct fdt_reserve_entry))) {
return err;
}
mem_rsv_size = (fdt_num_mem_rsv(fdt)+1)
* sizeof(struct fdt_reserve_entry);
if (fdt_version(fdt) >= 17) {
struct_size = fdt_size_dt_struct(fdt);
if (struct_size < 0)
return struct_size;
} else {
struct_size = 0;
while (fdt_next_tag(fdt, struct_size, &struct_size) != FDT_END)
@ -406,16 +419,22 @@ int fdt_open_into(const void *fdt, void *buf, int bufsize)
fdt_set_totalsize(buf, bufsize);
return 0;
}
if (((uint64_t)FDT_ALIGN(sizeof(struct fdt_header), 8) + (uint64_t)mem_rsv_size \
+ (uint64_t)struct_size + (uint64_t)fdt_size_dt_strings(fdt)) > UINT_MAX) {
return (err = -1);
}
/* Need to reorder */
newsize = FDT_ALIGN(sizeof(struct fdt_header), 8) + mem_rsv_size
+ struct_size + fdt_size_dt_strings(fdt);
if (bufsize < newsize)
return -FDT_ERR_NOSPACE;
/* First attempt to build converted tree at beginning of buffer */
tmp = buf;
if (((tmp + newsize) < tmp) || ((buf + bufsize) < buf)) {
return (err = -1);
}
/* But if that overlaps with the old tree... */
if (((tmp + newsize) > fdtstart) && (tmp < fdtend)) {
/* Try right after the old tree instead */