mirror of
https://github.com/dgibson/dtc.git
synced 2026-05-12 11:43:04 -04:00
47d7c01ba8
Some checks failed
Build test / build-make (alpine) (push) Has been cancelled
Build test / build-make (archlinux) (push) Has been cancelled
Build test / build-make (fedora) (push) Has been cancelled
Build test / build-make (ubuntu) (push) Has been cancelled
Build test / build-meson (alpine) (push) Has been cancelled
Build test / build-meson (archlinux) (push) Has been cancelled
Build test / build-meson (fedora) (push) Has been cancelled
Build test / build-meson (ubuntu) (push) Has been cancelled
Build test / clang64 (push) Has been cancelled
Build test / mingw32 (push) Has been cancelled
Build test / mingw64 (push) Has been cancelled
Build test / ucrt64 (push) Has been cancelled
fdt_num_mem_rsv() can return an error if the memory reservation block is not properly terminated with a (0, 0) entry. However several other places in libfdt called it without checking for error returns, and could therefore return strange results, or in the case of fdt_open_into() crash. Fix this by always checking the return value. Add some addition tests to catch this bug. Reported-by: Moshe Strauss <moshestrauss10@gmail.com> Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
67 lines
1.6 KiB
C
67 lines
1.6 KiB
C
// SPDX-License-Identifier: LGPL-2.1-or-later
|
|
/*
|
|
* libfdt - Flat Device Tree manipulation
|
|
* Testcase for misbehaviour on an unterminated memrsv map
|
|
* Copyright Red Hat
|
|
*
|
|
* Based on a proof of concept report from:
|
|
* Moshe Strauss <moshestrauss10@gmail.com>
|
|
*/
|
|
|
|
#include <stdlib.h>
|
|
#include <stdio.h>
|
|
#include <string.h>
|
|
#include <stdint.h>
|
|
|
|
#include <libfdt.h>
|
|
|
|
#include "tests.h"
|
|
#include "testdata.h"
|
|
|
|
#define SPACE 65536
|
|
|
|
int main(int argc, char *argv[])
|
|
{
|
|
void *fdt = &unterminated_memrsv;
|
|
void *buf;
|
|
int err;
|
|
uint64_t addr, size;
|
|
|
|
test_init(argc, argv);
|
|
|
|
err = fdt_check_header(fdt);
|
|
if (err != 0)
|
|
FAIL("Bad header: %s", fdt_strerror(err));
|
|
|
|
err = fdt_num_mem_rsv(fdt);
|
|
if (err != -FDT_ERR_TRUNCATED)
|
|
FAIL("fdt_num_mem_rsv() returned %d instead of -FDT_ERR_TRUNCATED",
|
|
err);
|
|
|
|
err = fdt_get_mem_rsv(fdt, 0, &addr, &size);
|
|
if (err != 0)
|
|
FAIL("fdt_get_mem_rsv() failed on first entry: %s",
|
|
fdt_strerror(err));
|
|
if ((addr != TEST_ADDR_1) || (size != TEST_SIZE_1))
|
|
FAIL("Entry doesn't match: (0x%llx, 0x%llx) != (0x%llx, 0x%llx)",
|
|
(unsigned long long)addr, (unsigned long long)size,
|
|
TEST_ADDR_1, TEST_SIZE_1);
|
|
|
|
err = fdt_add_mem_rsv(fdt, TEST_ADDR_2, TEST_SIZE_2);
|
|
if (err != -FDT_ERR_TRUNCATED)
|
|
FAIL("fdt_add_mem_rsv() returned %d instead of -FDT_ERR_TRUNCATED",
|
|
err);
|
|
|
|
err = fdt_del_mem_rsv(fdt, 0);
|
|
if (err != -FDT_ERR_TRUNCATED)
|
|
FAIL("fdt_del_mem_rsv() returned %d instead of -FDT_ERR_TRUNCATED",
|
|
err);
|
|
|
|
buf = xmalloc(SPACE);
|
|
err = fdt_open_into(fdt, buf, SPACE);
|
|
if (err != -FDT_ERR_TRUNCATED)
|
|
FAIL("fdt_open_into() returned %d instead of -FDT_ERR_TRUNCATED",
|
|
err);
|
|
|
|
PASS();
|
|
}
|