diff options
Diffstat (limited to 'scripts/dtc/libfdt')
| -rw-r--r-- | scripts/dtc/libfdt/fdt.c | 14 | ||||
| -rw-r--r-- | scripts/dtc/libfdt/fdt_rw.c | 2 |
2 files changed, 15 insertions, 1 deletions
diff --git a/scripts/dtc/libfdt/fdt.c b/scripts/dtc/libfdt/fdt.c index 2ce6a44179de..d96ed24509c7 100644 --- a/scripts/dtc/libfdt/fdt.c +++ b/scripts/dtc/libfdt/fdt.c @@ -71,6 +71,20 @@ int fdt_check_header(const void *fdt) return -FDT_ERR_BADMAGIC; } + if (fdt_off_dt_struct(fdt) > (UINT_MAX - fdt_size_dt_struct(fdt))) + return FDT_ERR_BADOFFSET; + + if (fdt_off_dt_strings(fdt) > (UINT_MAX - fdt_size_dt_strings(fdt))) + return FDT_ERR_BADOFFSET; + + if ((fdt_off_dt_struct(fdt) + fdt_size_dt_struct(fdt)) + > fdt_totalsize(fdt)) + return FDT_ERR_BADOFFSET; + + if ((fdt_off_dt_strings(fdt) + fdt_size_dt_strings(fdt)) + > fdt_totalsize(fdt)) + return FDT_ERR_BADOFFSET; + return 0; } diff --git a/scripts/dtc/libfdt/fdt_rw.c b/scripts/dtc/libfdt/fdt_rw.c index 70adec6c371b..4463c10f59e3 100644 --- a/scripts/dtc/libfdt/fdt_rw.c +++ b/scripts/dtc/libfdt/fdt_rw.c @@ -394,7 +394,7 @@ int fdt_del_node(void *fdt, int nodeoffset) static void _fdt_packblocks(const char *old, char *new, int mem_rsv_size, int struct_size) { - int mem_rsv_off, struct_off, strings_off; + uint32_t mem_rsv_off, struct_off, strings_off; mem_rsv_off = FDT_ALIGN(sizeof(struct fdt_header), 8); struct_off = mem_rsv_off + mem_rsv_size; |