From c81f432f77bc27911ef863c42d19dc6d5c395d82 Mon Sep 17 00:00:00 2001 From: David Gibson Date: Fri, 9 Mar 2018 23:28:56 +1100 Subject: libfdt: Safer access to memory reservations fdt_num_mem_rsv() and fdt_get_mem_rsv() currently don't sanity check their parameters, or the memory reserve section offset in the header. That means that on a corrupted blob they could access outside of the range of memory that they should. This improves their safety checking, meaning they shouldn't access outside the blob's bounds, even if its contents are badly corrupted. Signed-off-by: David Gibson Tested-by: Alexey Kardashevskiy Reviewed-by: Alexey Kardashevskiy Reviewed-by: Simon Glass --- cpukit/dtc/libfdt/fdt_ro.c | 33 +++++++++++++++++++++++++++------ 1 file changed, 27 insertions(+), 6 deletions(-) (limited to 'cpukit/dtc/libfdt/fdt_ro.c') diff --git a/cpukit/dtc/libfdt/fdt_ro.c b/cpukit/dtc/libfdt/fdt_ro.c index d4cec0efd1..c74b9629af 100644 --- a/cpukit/dtc/libfdt/fdt_ro.c +++ b/cpukit/dtc/libfdt/fdt_ro.c @@ -170,21 +170,42 @@ uint32_t fdt_get_max_phandle(const void *fdt) return 0; } +static const struct fdt_reserve_entry *fdt_mem_rsv(const void *fdt, int n) +{ + int offset = n * sizeof(struct fdt_reserve_entry); + int absoffset = fdt_off_mem_rsvmap(fdt) + offset; + + if (absoffset < fdt_off_mem_rsvmap(fdt)) + return NULL; + if (absoffset > fdt_totalsize(fdt) - sizeof(struct fdt_reserve_entry)) + return NULL; + return fdt_mem_rsv_(fdt, n); +} + int fdt_get_mem_rsv(const void *fdt, int n, uint64_t *address, uint64_t *size) { + const struct fdt_reserve_entry *re; + FDT_RO_PROBE(fdt); - *address = fdt64_to_cpu(fdt_mem_rsv_(fdt, n)->address); - *size = fdt64_to_cpu(fdt_mem_rsv_(fdt, n)->size); + re = fdt_mem_rsv(fdt, n); + if (!re) + return -FDT_ERR_BADOFFSET; + + *address = fdt64_to_cpu(re->address); + *size = fdt64_to_cpu(re->size); return 0; } int fdt_num_mem_rsv(const void *fdt) { - int i = 0; + int i; + const struct fdt_reserve_entry *re; - while (fdt64_to_cpu(fdt_mem_rsv_(fdt, i)->size) != 0) - i++; - return i; + for (i = 0; (re = fdt_mem_rsv(fdt, i)) != NULL; i++) { + if (fdt64_to_cpu(re->size) == 0) + return i; + } + return -FDT_ERR_TRUNCATED; } static int nextprop_(const void *fdt, int offset) -- cgit v1.2.3