From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bjorn Andersson Subject: [PATCH] libfdt: check for potential overrun in _fdt_splice() Date: Mon, 10 Aug 2015 11:39:02 -0700 Message-ID: <1439231942-28830-1-git-send-email-bjorn.andersson@sonymobile.com> Mime-Version: 1.0 Return-path: Sender: devicetree-compiler-owner-u79uwXL29TY76Z2rM5mHXA@public.gmane.org List-ID: Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: Grant Likely , Rob Herring Cc: devicetree-compiler-u79uwXL29TY76Z2rM5mHXA@public.gmane.org, Courtney Cavin From: Courtney Cavin Signed-off-by: Courtney Cavin Signed-off-by: Bjorn Andersson --- libfdt/fdt_rw.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/libfdt/fdt_rw.c b/libfdt/fdt_rw.c index 70adec6c371b..8be02b1f68f3 100644 --- a/libfdt/fdt_rw.c +++ b/libfdt/fdt_rw.c @@ -101,6 +101,8 @@ static int _fdt_splice(void *fdt, void *splicepoint, int oldlen, int newlen) if (((p + oldlen) < p) || ((p + oldlen) > end)) return -FDT_ERR_BADOFFSET; + if ((p < (char *)fdt) || ((end - oldlen + newlen) < (char *)fdt)) + return -FDT_ERR_BADOFFSET; if ((end - oldlen + newlen) > ((char *)fdt + fdt_totalsize(fdt))) return -FDT_ERR_NOSPACE; memmove(p + newlen, p + oldlen, end - p - oldlen); -- 1.8.2.2