[PATCH 3/4] libfdt: Check DT struct size for integer overflow

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

The DTB header fields store unsigned values for size and offset, however
we have a 2 GB limit on the overall size, since we use signed "node"
offsets everywhere.

As fdt_open_into() is no exception here, check that the advertised DT
structure size fits in an int, before using that value as an offset into
a buffer.

Signed-off-by: Andre Przywara <andre.przywara@xxxxxxx>
 libfdt/fdt_rw.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/libfdt/fdt_rw.c b/libfdt/fdt_rw.c
index a0f03d0..062edcc 100644
--- a/libfdt/fdt_rw.c
+++ b/libfdt/fdt_rw.c
@@ -437,6 +437,8 @@ int fdt_open_into(const void *fdt, void *buf, int bufsize)
 	if (can_assume(LATEST) || fdt_version(fdt) >= 17) {
 		struct_size = fdt_size_dt_struct(fdt);
+		if (!can_assume(VALID_DTB) && struct_size < 0)
+			return -FDT_ERR_NOSPACE;
 	} else if (fdt_version(fdt) == 16) {
 		struct_size = 0;
 		while (fdt_next_tag(fdt, struct_size, &struct_size) != FDT_END)

[Index of Archives]     [Device Tree]     [Device Tree Spec]     [Linux Driver Backports]     [Video for Linux]     [Linux USB Devel]     [Linux Audio Users]     [Linux Kernel]     [Linux SCSI]     [Yosemite Backpacking]

  Powered by Linux