From 1a8d3b8024c670b1608b61fbc129183af331a57e Mon Sep 17 00:00:00 2001 From: Vijay Kumar Pendoti Date: Tue, 12 Aug 2014 20:35:44 +0530 Subject: [PATCH] dtc: add integer overflow checks in fdt header Protect against integer overflows caused by malformed fdt headers. CRs-Fixed: 749977 Change-Id: I51d87038f520bc761b163d291b0138c513c69a33 Signed-off-by: Vijay Kumar Pendoti Signed-off-by: Matt Wagantall --- include/linux/libfdt_env.h | 1 + scripts/dtc/libfdt/fdt.c | 14 ++++++++++++++ scripts/dtc/libfdt/fdt_rw.c | 2 +- 3 files changed, 16 insertions(+), 1 deletion(-) diff --git a/include/linux/libfdt_env.h b/include/linux/libfdt_env.h index 2a663c6bb428..b01d2944ebdd 100644 --- a/include/linux/libfdt_env.h +++ b/include/linux/libfdt_env.h @@ -1,6 +1,7 @@ #ifndef _LIBFDT_ENV_H #define _LIBFDT_ENV_H +#include #include #include diff --git a/scripts/dtc/libfdt/fdt.c b/scripts/dtc/libfdt/fdt.c index 22286a1aaeaf..14fb793ed05d 100644 --- a/scripts/dtc/libfdt/fdt.c +++ b/scripts/dtc/libfdt/fdt.c @@ -71,6 +71,20 @@ int fdt_check_header(const void *fdt) return -FDT_ERR_BADMAGIC; } + if (fdt_off_dt_struct(fdt) > (UINT_MAX - fdt_size_dt_struct(fdt))) + return FDT_ERR_BADOFFSET; + + if (fdt_off_dt_strings(fdt) > (UINT_MAX - fdt_size_dt_strings(fdt))) + return FDT_ERR_BADOFFSET; + + if ((fdt_off_dt_struct(fdt) + fdt_size_dt_struct(fdt)) + > fdt_totalsize(fdt)) + return FDT_ERR_BADOFFSET; + + if ((fdt_off_dt_strings(fdt) + fdt_size_dt_strings(fdt)) + > fdt_totalsize(fdt)) + return FDT_ERR_BADOFFSET; + return 0; } diff --git a/scripts/dtc/libfdt/fdt_rw.c b/scripts/dtc/libfdt/fdt_rw.c index 8be02b1f68f3..468e169285c0 100644 --- a/scripts/dtc/libfdt/fdt_rw.c +++ b/scripts/dtc/libfdt/fdt_rw.c @@ -396,7 +396,7 @@ int fdt_del_node(void *fdt, int nodeoffset) static void _fdt_packblocks(const char *old, char *new, int mem_rsv_size, int struct_size) { - int mem_rsv_off, struct_off, strings_off; + uint32_t mem_rsv_off, struct_off, strings_off; mem_rsv_off = FDT_ALIGN(sizeof(struct fdt_header), 8); struct_off = mem_rsv_off + mem_rsv_size;