Piteball
/
android_kernel_samsung_msm8226
mirror of https://github.com/S3NEO/android_kernel_samsung_msm8226.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

dtc: add integer overflow checks in fdt header 

Protect against integer overflows caused by malformed fdt headers.

CRs-Fixed: 749977
Change-Id: I51d87038f520bc761b163d291b0138c513c69a33
Signed-off-by: Vijay Kumar Pendoti <vpendo@codeaurora.org>
Signed-off-by: Matt Wagantall <mattw@codeaurora.org>
This commit is contained in:
Vijay Kumar Pendoti 2014-08-12 20:35:44 +05:30 committed by Matt Wagantall
parent 83d17d0cb8
commit b19d8b8f78
3 changed files with 16 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
arch/arm/boot/compressed/libfdt_env.h
View File

@ -1,6 +1,7 @@
#ifndef _ARM_LIBFDT_ENV_H
#define _ARM_LIBFDT_ENV_H
#include <linux/kernel.h>
#include <linux/types.h>
#include <linux/string.h>
#include <asm/byteorder.h>

14
scripts/dtc/libfdt/fdt.c
View File

@ -71,6 +71,20 @@ int fdt_check_header(const void *fdt)
return -FDT_ERR_BADMAGIC;
}
if (fdt_off_dt_struct(fdt) > (UINT_MAX - fdt_size_dt_struct(fdt)))
return FDT_ERR_BADOFFSET;
if (fdt_off_dt_strings(fdt) > (UINT_MAX - fdt_size_dt_strings(fdt)))
return FDT_ERR_BADOFFSET;
if ((fdt_off_dt_struct(fdt) + fdt_size_dt_struct(fdt))
> fdt_totalsize(fdt))
return FDT_ERR_BADOFFSET;
if ((fdt_off_dt_strings(fdt) + fdt_size_dt_strings(fdt))
> fdt_totalsize(fdt))
return FDT_ERR_BADOFFSET;
return 0;
}

2
scripts/dtc/libfdt/fdt_rw.c
View File

@ -394,7 +394,7 @@ int fdt_del_node(void *fdt, int nodeoffset)
static void _fdt_packblocks(const char *old, char *new,
int mem_rsv_size, int struct_size)
{
int mem_rsv_off, struct_off, strings_off;
uint32_t mem_rsv_off, struct_off, strings_off;
mem_rsv_off = FDT_ALIGN(sizeof(struct fdt_header), 8);
struct_off = mem_rsv_off + mem_rsv_size;