evie/android_kernel_oneplus_msm8998
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

dtc: add integer overflow checks in fdt header

Browse source 
Protect against integer overflows caused by malformed fdt headers.

CRs-Fixed: 749977
Change-Id: I51d87038f520bc761b163d291b0138c513c69a33
Signed-off-by: Vijay Kumar Pendoti <vpendo@codeaurora.org>
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
This commit is contained in:
Vijay Kumar Pendoti 2014-08-12 20:35:44 +05:30 • committed by David Keitel
parent fb89f1cbee
commit 7f055e49d5
3 changed files with 16 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
include/linux/libfdt_env.h
View file

@ -1,6 +1,7 @@
#ifndef _LIBFDT_ENV_H
#define _LIBFDT_ENV_H
#include <linux/kernel.h>
#include <linux/string.h>
#include <asm/byteorder.h>

14
scripts/dtc/libfdt/fdt.c
View file

@ -71,6 +71,20 @@ int fdt_check_header(const void *fdt)
return -FDT_ERR_BADMAGIC;
}
if (fdt_off_dt_struct(fdt) > (UINT_MAX - fdt_size_dt_struct(fdt)))
return FDT_ERR_BADOFFSET;
if (fdt_off_dt_strings(fdt) > (UINT_MAX - fdt_size_dt_strings(fdt)))
return FDT_ERR_BADOFFSET;
if ((fdt_off_dt_struct(fdt) + fdt_size_dt_struct(fdt))
> fdt_totalsize(fdt))
return FDT_ERR_BADOFFSET;
if ((fdt_off_dt_strings(fdt) + fdt_size_dt_strings(fdt))
> fdt_totalsize(fdt))
return FDT_ERR_BADOFFSET;
return 0;
}

2
scripts/dtc/libfdt/fdt_rw.c
View file

@ -394,7 +394,7 @@ int fdt_del_node(void *fdt, int nodeoffset)
static void _fdt_packblocks(const char *old, char *new,
int mem_rsv_size, int struct_size)
{
int mem_rsv_off, struct_off, strings_off;
uint32_t mem_rsv_off, struct_off, strings_off;
mem_rsv_off = FDT_ALIGN(sizeof(struct fdt_header), 8);
struct_off = mem_rsv_off + mem_rsv_size;