[U-Boot] [PATCHv2] fdt_support: Fix buffer overflow in fdt_fixup_memory_banks

[U-Boot] [PATCHv2] fdt_support: Fix buffer overflow in fdt_fixup_memory_banks

[Kyle Moffett]

When fdt_fixup_memory_banks is called with 2-cell address and size
fields in the device-tree (IE: 64-bit address and size), then it will
overflow its on-stack "tmp" buffer.

This fixes the buffer size and adds a comment explaining how many bytes
need to be allocated per record.

Signed-off-by: Kyle Moffett <Kyle.D.Moffett@boeing.com>
Cc: Jerry Van Baren <vanbaren@cideas.com>
---
Changelog:
  v2: Resubmitted separately from the other HWW-1U-1A changes.

 common/fdt_support.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)

diff --git a/common/fdt_support.c b/common/fdt_support.c
index 6c98e5b..edcf04a 100644
--- a/common/fdt_support.c
+++ b/common/fdt_support.c
@@ -394,7 +394,7 @@ int fdt_fixup_memory_banks(void *blob, u64 start[], u64 size[], int banks)
 {
 	int err, nodeoffset;
 	int addr_cell_len, size_cell_len, len;
-	u8 tmp[banks * 8];
+	u8 tmp[banks * 16]; /* Up to 64-bit address + 64-bit size */
 	int bank;
 
 	err = fdt_check_header(blob);
-- 
1.7.2.3

[U-Boot] [PATCHv2] fdt_support: Fix buffer overflow in fdt_fixup_memory_banks

[Gerald Van Baren]

Dear Wolfgang,

Can you apply this patch for me?  Otherwise I'll apply it to my repo and 
send a pull request.

Acked-by: Gerald Van Baren <vanbaren@cideas.com>

Thanks,
gvb

On 02/23/2011 11:18 AM, Kyle Moffett wrote:
> When fdt_fixup_memory_banks is called with 2-cell address and size
> fields in the device-tree (IE: 64-bit address and size), then it will
> overflow its on-stack "tmp" buffer.
>
> This fixes the buffer size and adds a comment explaining how many bytes
> need to be allocated per record.
>
> Signed-off-by: Kyle Moffett<Kyle.D.Moffett@boeing.com>
> Cc: Jerry Van Baren<vanbaren@cideas.com>
> ---
> Changelog:
>    v2: Resubmitted separately from the other HWW-1U-1A changes.
>
>   common/fdt_support.c |    2 +-
>   1 files changed, 1 insertions(+), 1 deletions(-)
>
> diff --git a/common/fdt_support.c b/common/fdt_support.c
> index 6c98e5b..edcf04a 100644
> --- a/common/fdt_support.c
> +++ b/common/fdt_support.c
> @@ -394,7 +394,7 @@ int fdt_fixup_memory_banks(void *blob, u64 start[], u64 size[], int banks)
>   {
>   	int err, nodeoffset;
>   	int addr_cell_len, size_cell_len, len;
> -	u8 tmp[banks * 8];
> +	u8 tmp[banks * 16]; /* Up to 64-bit address + 64-bit size */
>   	int bank;
>
>   	err = fdt_check_header(blob);

[U-Boot] [PATCHv2] fdt_support: Fix buffer overflow in fdt_fixup_memory_banks

[Jerry Van Baren]

On 02/23/2011 11:18 AM, Kyle Moffett wrote:
> When fdt_fixup_memory_banks is called with 2-cell address and size
> fields in the device-tree (IE: 64-bit address and size), then it will
> overflow its on-stack "tmp" buffer.
>
> This fixes the buffer size and adds a comment explaining how many bytes
> need to be allocated per record.
>
> Signed-off-by: Kyle Moffett<Kyle.D.Moffett@boeing.com>
> Cc: Jerry Van Baren<vanbaren@cideas.com>
> ---
> Changelog:
>     v2: Resubmitted separately from the other HWW-1U-1A changes.

Applied to u-boot-fdt, thanks.

gvb