diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2019-04-10 08:57:19 +0100 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2019-04-10 08:57:19 +0100 |
| commit | 6523516f321208b46a6be821c443d4b960c0c24c (patch) | |
| tree | be396b9fa2655a5947fcbed48ceb087f86bf2397 | |
| parent | f151f8aca5cf5da24f6eb743a55a2233091ae532 (diff) | |
| parent | 065e6298a75164b4347682b63381dbe752c2b156 (diff) | |
Merge remote-tracking branch 'remotes/alistair/tags/pull-device-tree-20190409-1' into staging
Single device tree fix for 4.0
A single patch to avoid an overflow when loading device trees.
# gpg: Signature made Wed 10 Apr 2019 00:52:16 BST
# gpg: using RSA key F6C4AC46D4934868D3B8CE8F21E10D29DF977054
# gpg: Good signature from "Alistair Francis <alistair@alistair23.me>" [full]
# Primary key fingerprint: F6C4 AC46 D493 4868 D3B8 CE8F 21E1 0D29 DF97 7054
* remotes/alistair/tags/pull-device-tree-20190409-1:
device_tree: Fix integer overflowing in load_device_tree()
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | device_tree.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/device_tree.c b/device_tree.c index 296278e12a..f8b46b3c73 100644 --- a/device_tree.c +++ b/device_tree.c @@ -84,6 +84,10 @@ void *load_device_tree(const char *filename_path, int *sizep) filename_path); goto fail; } + if (dt_size > INT_MAX / 2 - 10000) { + error_report("Device tree file '%s' is too large", filename_path); + goto fail; + } /* Expand to 2x size to give enough room for manipulation. */ dt_size += 10000; |