fdt_support: Fix buffer overflow in fdt_fixup_memory_banks
PATCH v2 1/1 fdt_support: Fix buffer overflow in fdt_fixup_memory_banks
When fdt_fixup_memory_banks is called with 2-cell address and size fields in the device-tree (IE: 64-bit address and size), then it will overflow its on-stack "tmp" buffer.
This fixes the buffer size and adds a comment explaining how many bytes need to be allocated per record.
---
Changelog:
v2: Resubmitted separately from the other HWW-1U-1A changes.
common/fdt_support.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)
common/fdt_support.c +1 -1
@@ -394,7 +394,7 @@ int fdt_fixup_memory_banks(void *blob, u64 start[], u64 size[], int banks) {int err, nodeoffset;int addr_cell_len, size_cell_len, len; -u8 tmp[banks *8 ]; +u8 tmp[banks *16 ];/* Up to 64-bit address + 64-bit size */ int bank; err =fdt_check_header (blob);
Signature · 1 line
1.7.2.3
PATCH v2 1/1 fdt_support: Fix buffer overflow in fdt_fixup_memory_banks
Dear Wolfgang,
Can you apply this patch for me? Otherwise I'll apply it to my repo and send a pull request.
Thanks,
gvb
Quoted 29 lines · Kyle Moffett
When
fdt_fixup_memory_banksis called with 2-cell address and size fields in the device-tree (IE: 64-bit address and size), then it will overflow its on-stack "tmp" buffer.This fixes the buffer size and adds a comment explaining how many bytes need to be allocated per record.
Signed-off-by Kyle Moffett<[email protected]>Cc Jerry Van Baren<[email protected]>---
Changelog:
v2: Resubmitted separately from the other HWW-1U-1A changes.common/fdt_support.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)common/fdt_support.c +1
-1@@ -394,7 +394,7 @@ int fdt_fixup_memory_banks(void *blob, u64 start[], u64 size[], int banks) {int err, nodeoffset;int addr_cell_len, size_cell_len, len; -u8 tmp[banks *8 ]; +u8 tmp[banks *16 ];/* Up to 64-bit address + 64-bit size */ int bank; err =fdt_check_header (blob);
PATCH v2 1/1 fdt_support: Fix buffer overflow in fdt_fixup_memory_banks
Quoted 4 lines · Kyle Moffett
When
fdt_fixup_memory_banksis called with 2-cell address and size fields in the device-tree (IE: 64-bit address and size), then it will overflow its on-stack "tmp" buffer.
Quoted 8 lines
This fixes the buffer size and adds a comment explaining how many bytes need to be allocated per record.
Signed-off-by Kyle Moffett<[email protected]>Cc Jerry Van Baren<[email protected]>---
Changelog:
v2: Resubmitted separately from the other HWW-1U-1A changes.
Applied to u-boot-fdt, thanks.
gvb