Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 30e0af15 authored by Linux Build Service Account's avatar Linux Build Service Account Committed by Gerrit - the friendly Code Review server
Browse files

Merge "dtc: add integer overflow checks in fdt header" into msm-next

parents 3bda0bac 3040709f

include/linux/libfdt_env.h

+1 −0
Original line number Diff line number Diff line 
#ifndef _LIBFDT_ENV_H

#define _LIBFDT_ENV_H



#include <linux/kernel.h>

#include <linux/string.h>



#include <asm/byteorder.h>

scripts/dtc/libfdt/fdt.c

+14 −0
Original line number Diff line number Diff line
@@ -71,6 +71,20 @@ int fdt_check_header(const void *fdt) 
		return -FDT_ERR_BADMAGIC;

	}



	if (fdt_off_dt_struct(fdt) > (UINT_MAX - fdt_size_dt_struct(fdt)))

		return FDT_ERR_BADOFFSET;



	if (fdt_off_dt_strings(fdt) > (UINT_MAX -  fdt_size_dt_strings(fdt)))

		return FDT_ERR_BADOFFSET;



	if ((fdt_off_dt_struct(fdt) + fdt_size_dt_struct(fdt))

	    > fdt_totalsize(fdt))

		return FDT_ERR_BADOFFSET;



	if ((fdt_off_dt_strings(fdt) + fdt_size_dt_strings(fdt))

	    > fdt_totalsize(fdt))

		return FDT_ERR_BADOFFSET;



	return 0;

}

scripts/dtc/libfdt/fdt_rw.c

+1 −1
Original line number Diff line number Diff line
@@ -393,7 +393,7 @@ int fdt_del_node(void *fdt, int nodeoffset) 
static void _fdt_packblocks(const char *old, char *new,

			    int mem_rsv_size, int struct_size)

{

	int mem_rsv_off, struct_off, strings_off;

	uint32_t mem_rsv_off, struct_off, strings_off;



	mem_rsv_off = FDT_ALIGN(sizeof(struct fdt_header), 8);

	struct_off = mem_rsv_off + mem_rsv_size;