commit 3144a08e9eae74b2c6300d87fbbc6b9ffb399b58
author Linux Build Service Account <lnxbuild@localhost> Sat Aug 30 22:37:40 2014 -0700
committer Gerrit - the friendly Code Review server <code-review@localhost> Sat Aug 30 22:37:40 2014 -0700
tree be510bebd5e15d3e8b19f128cff98f27b2fde2a0
parent 70328d596b05ac6a92b0cd0ee4500b3fc34cc78e
parent 222e0ec9bc755bfeaa74f9a0052b7c709a4ad054

Merge "lib: fdt: add integer overflow checks in fdt header"

lib/libfdt/fdt.c

diff --git a/lib/libfdt/fdt.c b/lib/libfdt/fdt.c
index e56833a..3267a1c 100644
--- a/lib/libfdt/fdt.c
+++ b/lib/libfdt/fdt.c
@@ -71,6 +71,18 @@
 		return -FDT_ERR_BADMAGIC;
 	}
 
+	if (fdt_off_dt_struct(fdt) > (UINT_MAX - fdt_size_dt_struct(fdt)))
+		return FDT_ERR_BADOFFSET;
+
+	if (fdt_off_dt_strings(fdt) > (UINT_MAX -  fdt_size_dt_strings(fdt)))
+		return FDT_ERR_BADOFFSET;
+
+	if ((fdt_off_dt_struct(fdt) + fdt_size_dt_struct(fdt)) > fdt_totalsize(fdt))
+		return FDT_ERR_BADOFFSET;
+
+	if ((fdt_off_dt_strings(fdt) + fdt_size_dt_strings(fdt)) > fdt_totalsize(fdt))
+		return FDT_ERR_BADOFFSET;
+
 	return 0;
 }
 

lib/libfdt/fdt_rw.c

diff --git a/lib/libfdt/fdt_rw.c b/lib/libfdt/fdt_rw.c
index a3f8fad..35f4bc3 100644
--- a/lib/libfdt/fdt_rw.c
+++ b/lib/libfdt/fdt_rw.c
@@ -432,7 +432,7 @@
 static void _fdt_packblocks(const char *old, char *new,
 			    int mem_rsv_size, int struct_size)
 {
-	int mem_rsv_off, struct_off, strings_off;
+	uint32_t mem_rsv_off, struct_off, strings_off;
 
 	mem_rsv_off = FDT_ALIGN(sizeof(struct fdt_header), 8);
 	struct_off = mem_rsv_off + mem_rsv_size;