len0rd/dtc
1
0
Fork 0
mirror of https://github.com/dgibson/dtc.git synced 2025-10-13 16:27:39 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

Catch unsigned 32bit overflow when parsing flattened device tree offsets

Browse source 
We have a couple of checks of the form:

    if (offset+size > totalsize)
        die();

We need to check that offset+size doesn't overflow, otherwise the check
will pass, and we may access past totalsize.

Found with AFL.

Signed-off-by: Anton Blanchard <anton@samba.org>
[Added a testcase]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
This commit is contained in:
Anton Blanchard 2016-01-03 08:43:35 +11:00 • committed by David Gibson
parent b06e55c88b
commit 2e53f9d2f0
5 changed files with 37 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
flattree.c
View file

@ -889,7 +889,7 @@ struct boot_info *dt_from_blob(const char *fname)
if (version >= 3) {
uint32_t size_str = fdt32_to_cpu(fdt->size_dt_strings);
if (off_str+size_str > totalsize)
if ((off_str+size_str < off_str) || (off_str+size_str > totalsize))
die("String table extends past total size\n");
inbuf_init(&strbuf, blob + off_str, blob + off_str + size_str);
} else {
@ -898,7 +898,7 @@ struct boot_info *dt_from_blob(const char *fname)
if (version >= 17) {
size_dt = fdt32_to_cpu(fdt->size_dt_struct);
if (off_dt+size_dt > totalsize)
if ((off_dt+size_dt < off_dt) || (off_dt+size_dt > totalsize))
die("Structure block extends past total size\n");
}