Mirrors/u-boot
2
0
Fork 0
mirror of https://github.com/AsahiLinux/u-boot synced 2024-11-25 22:20:45 +00:00
Code Issues Projects Releases Packages Wiki Activity

fdt_support: Fix buffer overflow in fdt_fixup_memory_banks

Browse source 
When fdt_fixup_memory_banks is called with 2-cell address and size
fields in the device-tree (IE: 64-bit address and size), then it will
overflow its on-stack "tmp" buffer.

This fixes the buffer size and adds a comment explaining how many bytes
need to be allocated per record.

Signed-off-by: Kyle Moffett <Kyle.D.Moffett@boeing.com>
Cc: Jerry Van Baren <vanbaren@cideas.com>
Acked-by: Gerald Van Baren <vanbaren@cideas.com>
This commit is contained in:
Kyle Moffett 2011-02-23 06:18:24 +00:00 committed by Gerald Van Baren
parent 73e5476e1e
commit d13ffa66af
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
common/fdt_support.c
View file

@ -394,7 +394,7 @@ int fdt_fixup_memory_banks(void *blob, u64 start[], u64 size[], int banks)
{ {
int err, nodeoffset; int err, nodeoffset;
int addr_cell_len, size_cell_len, len; int addr_cell_len, size_cell_len, len;
u8 tmp[banks * 8]; u8 tmp[banks * 16]; /* Up to 64-bit address + 64-bit size */
int bank; int bank;
err = fdt_check_header(blob); err = fdt_check_header(blob);