tequilaOS/platform_external_dtc
2
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity

[automerge] Fix integer wrap sanitisation. 2p: 2b597691ef

Browse source 
Original change: https://googleplex-android-review.googlesource.com/c/platform/external/dtc/+/19606333

Bug: 239630493
Bug: 242096164
Change-Id: I9da82843a5e1c3230e2942d1732ce66abe18ed2f
Merged-In: I232155e7f7a54271a6a3e3a7cd91ed6bbabc051f
This commit is contained in:
Presubmit Automerger Backend 2022-08-12 10:51:38 +00:00
commit 312bb25a2c
1 changed files with 14 additions and 5 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

19
libfdt/fdt.c
View file

@ -180,12 +180,20 @@ uint32_t fdt_next_tag(const void *fdt, int startoffset, int *nextoffset)
break;
case FDT_PROP:
lenp = fdt_offset_ptr(fdt, offset, sizeof(*lenp));
lenp = fdt_offset_ptr(fdt, offset, sizeof(struct fdt_property) - FDT_TAGSIZE);
if (!can_assume(VALID_DTB) && !lenp)
return FDT_END; /* premature end */
/* skip-name offset, length and value */
offset += sizeof(struct fdt_property) - FDT_TAGSIZE
+ fdt32_to_cpu(*lenp);
/* skip name offset, length */
offset += sizeof(struct fdt_property) - FDT_TAGSIZE;
if (!can_assume(VALID_DTB)
&& !fdt_offset_ptr(fdt, offset, fdt32_to_cpu(*lenp)))
return FDT_END; /* premature end */
/* skip value */
offset += fdt32_to_cpu(*lenp);
if (!can_assume(LATEST) &&
fdt_version(fdt) < 0x10 && fdt32_to_cpu(*lenp) >= 8 &&
((offset - fdt32_to_cpu(*lenp)) % 8) != 0)
@ -201,7 +209,8 @@ uint32_t fdt_next_tag(const void *fdt, int startoffset, int *nextoffset)
return FDT_END;
}
if (!fdt_offset_ptr(fdt, startoffset, offset - startoffset))
if (!can_assume(VALID_DTB) && (offset <= startoffset
|| !fdt_offset_ptr(fdt, startoffset, offset - startoffset)))
return FDT_END; /* premature end */
*nextoffset = FDT_TAGALIGN(offset);