From ef95f6c3b1a33d5c6460ea9ba1947d868872473e Mon Sep 17 00:00:00 2001 From: Vijay Kumar Pendoti Date: Tue, 12 Aug 2014 20:35:44 +0530 Subject: [PATCH] dtc: add integer overflow checks in fdt header Protect against integer overflows caused by malformed fdt headers. [eberman@codeaurora.org: most of changes have been fixed in commit f858927fd6ce ("scripts/dtc: Update to upstream version v1.4.7-14-gc86da84d30e4"). The upstream was commit eb890c0f77dc ("libfdt: Make fdt_check_header() more thorough"))] CRs-Fixed: 749977 Change-Id: I51d87038f520bc761b163d291b0138c513c69a33 Signed-off-by: Vijay Kumar Pendoti Signed-off-by: Elliot Berman --- scripts/dtc/libfdt/fdt_rw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/scripts/dtc/libfdt/fdt_rw.c b/scripts/dtc/libfdt/fdt_rw.c index 2e49855d7cf8..3759ae4d064a 100644 --- a/scripts/dtc/libfdt/fdt_rw.c +++ b/scripts/dtc/libfdt/fdt_rw.c @@ -407,7 +407,7 @@ int fdt_del_node(void *fdt, int nodeoffset) static void fdt_packblocks_(const char *old, char *new, int mem_rsv_size, int struct_size) { - int mem_rsv_off, struct_off, strings_off; + uint32_t mem_rsv_off, struct_off, strings_off; mem_rsv_off = FDT_ALIGN(sizeof(struct fdt_header), 8); struct_off = mem_rsv_off + mem_rsv_size;