Changeset 80eaf45 in rtems

Timestamp:

07/09/18 04:50:38 (5 years ago)

Author:

David Gibson <david@…>

Branches:

5, master

Children:

2af004e

Parents:

4fd05d3

git-author:

David Gibson <david@…> (07/09/18 04:50:38)

git-committer:

Sebastian Huber <sebastian.huber@…> (07/19/18 05:01:12)

Message:

libfdt: Add necessary header padding in fdt_create()

At present fdt_create() will succeed if there is exactly enough space to
put in the fdt header. However, it sets the off_mem_rsvmap field, a few
bytes past that in order to align the memory reservation block.

Having block pointers pointing past the end of the fdt is pretty ugly, even
if it is just a transient state. Worse, if fdt_resize() is called at
exactly the wrong time, it can end up accessing data past the blob's
allocated space because of this.

So, correct fdt_create() to ensure that there is sufficient space for the
alignment padding as well as the plain header. For paranoia, also add a
check in fdt_resize() to make sure we don't copy data from outside the
blob's bounds.

Signed-off-by: David Gibson <david@…>

File:

• cpukit/dtc/libfdt/fdt_sw.c (modified) (3 diffs)

cpukit/dtc/libfdt/fdt_sw.c

@@ -144 +144 @@
 int fdt_create(void *buf, int bufsize)
 {
+        const size_t hdrsize = FDT_ALIGN(sizeof(struct fdt_header),
+                                         sizeof(struct fdt_reserve_entry));
         void *fdt = buf;
 
-        if (bufsize < sizeof(struct fdt_header))
+        if (bufsize < hdrsize)
                 return -FDT_ERR_NOSPACE;
 
@@ -156 +158 @@
         fdt_set_totalsize(fdt,  bufsize);
 
-        fdt_set_off_mem_rsvmap(fdt, FDT_ALIGN(sizeof(struct fdt_header),
-                                              sizeof(struct fdt_reserve_entry)));
+        fdt_set_off_mem_rsvmap(fdt, hdrsize);
         fdt_set_off_dt_struct(fdt, fdt_off_mem_rsvmap(fdt));
         fdt_set_off_dt_strings(fdt, 0);
@@ -173 +174 @@
         headsize = fdt_off_dt_struct(fdt) + fdt_size_dt_struct(fdt);
         tailsize = fdt_size_dt_strings(fdt);
+
+        if ((headsize + tailsize) > fdt_totalsize(fdt))
+                return -FDT_ERR_INTERNAL;
 
         if ((headsize + tailsize) > bufsize)