From 7f055e49d5b23bba1980a22ecc2062f36e7a12ba Mon Sep 17 00:00:00 2001 From: Vijay Kumar Pendoti Date: Tue, 12 Aug 2014 20:35:44 +0530 Subject: dtc: add integer overflow checks in fdt header Protect against integer overflows caused by malformed fdt headers. CRs-Fixed: 749977 Change-Id: I51d87038f520bc761b163d291b0138c513c69a33 Signed-off-by: Vijay Kumar Pendoti Signed-off-by: Matt Wagantall --- scripts/dtc/libfdt/fdt.c | 14 ++++++++++++++ scripts/dtc/libfdt/fdt_rw.c | 2 +- 2 files changed, 15 insertions(+), 1 deletion(-) (limited to 'scripts') diff --git a/scripts/dtc/libfdt/fdt.c b/scripts/dtc/libfdt/fdt.c index 2ce6a44179de..d96ed24509c7 100644 --- a/scripts/dtc/libfdt/fdt.c +++ b/scripts/dtc/libfdt/fdt.c @@ -71,6 +71,20 @@ int fdt_check_header(const void *fdt) return -FDT_ERR_BADMAGIC; } + if (fdt_off_dt_struct(fdt) > (UINT_MAX - fdt_size_dt_struct(fdt))) + return FDT_ERR_BADOFFSET; + + if (fdt_off_dt_strings(fdt) > (UINT_MAX - fdt_size_dt_strings(fdt))) + return FDT_ERR_BADOFFSET; + + if ((fdt_off_dt_struct(fdt) + fdt_size_dt_struct(fdt)) + > fdt_totalsize(fdt)) + return FDT_ERR_BADOFFSET; + + if ((fdt_off_dt_strings(fdt) + fdt_size_dt_strings(fdt)) + > fdt_totalsize(fdt)) + return FDT_ERR_BADOFFSET; + return 0; } diff --git a/scripts/dtc/libfdt/fdt_rw.c b/scripts/dtc/libfdt/fdt_rw.c index 70adec6c371b..4463c10f59e3 100644 --- a/scripts/dtc/libfdt/fdt_rw.c +++ b/scripts/dtc/libfdt/fdt_rw.c @@ -394,7 +394,7 @@ int fdt_del_node(void *fdt, int nodeoffset) static void _fdt_packblocks(const char *old, char *new, int mem_rsv_size, int struct_size) { - int mem_rsv_off, struct_off, strings_off; + uint32_t mem_rsv_off, struct_off, strings_off; mem_rsv_off = FDT_ALIGN(sizeof(struct fdt_header), 8); struct_off = mem_rsv_off + mem_rsv_size; -- cgit v1.2.3