From b41cd6cb076e465346cb0b02899bea74ad8f18d9 Mon Sep 17 00:00:00 2001 From: Courtney Cavin Date: Tue, 1 Dec 2015 16:43:10 -0800 Subject: libfdt: check for potential overrun in _fdt_splice() This patch catches the conditions where: - 'splicepoint' is set to a point outside of [ fdt, fdt_totalsize(fdt) ) - 'newlen' is negative, or 'splicepoint' plus 'newlen' results in overflow Either of these cases can be caused by math which overflows in calling functions, or by sizes specified through dynamic means. Signed-off-by: Courtney Cavin Signed-off-by: Bjorn Andersson --- cpukit/dtc/libfdt/fdt_rw.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/cpukit/dtc/libfdt/fdt_rw.c b/cpukit/dtc/libfdt/fdt_rw.c index 70adec6c37..8be02b1f68 100644 --- a/cpukit/dtc/libfdt/fdt_rw.c +++ b/cpukit/dtc/libfdt/fdt_rw.c @@ -101,6 +101,8 @@ static int _fdt_splice(void *fdt, void *splicepoint, int oldlen, int newlen) if (((p + oldlen) < p) || ((p + oldlen) > end)) return -FDT_ERR_BADOFFSET; + if ((p < (char *)fdt) || ((end - oldlen + newlen) < (char *)fdt)) + return -FDT_ERR_BADOFFSET; if ((end - oldlen + newlen) > ((char *)fdt + fdt_totalsize(fdt))) return -FDT_ERR_NOSPACE; memmove(p + newlen, p + oldlen, end - p - oldlen); -- cgit v1.2.3