Patchwork [U-Boot,6/7] fdt_support: Fix buffer overflow in fdt_fixup_memory_banks

login
register
mail settings
Submitter Kyle Moffett
Date Feb. 21, 2011, 5:59 p.m.
Message ID <1298311199-18775-7-git-send-email-Kyle.D.Moffett@boeing.com>
Download mbox | patch
Permalink /patch/83918/
State Accepted
Commit d13ffa66aff1d9aed9081986492fb74c1a61a4a9
Headers show

Comments

Kyle Moffett - Feb. 21, 2011, 5:59 p.m.
When fdt_fixup_memory_banks is called with 2-cell address and size
fields in the device-tree (IE: 64-bit address and size), then it will
overflow its on-stack "tmp" buffer.

This fixes the buffer size and adds a comment explaining how many bytes
need to be allocated per record.

Signed-off-by: Kyle Moffett <Kyle.D.Moffett@boeing.com>
---
 common/fdt_support.c |    2 +-
 1 files changed, 1 insertions(+), 1 deletions(-)
Wolfgang Denk - Feb. 21, 2011, 9:25 p.m.
Dear Kyle Moffett,

In message <1298311199-18775-7-git-send-email-Kyle.D.Moffett@boeing.com> you wrote:
> When fdt_fixup_memory_banks is called with 2-cell address and size
> fields in the device-tree (IE: 64-bit address and size), then it will
> overflow its on-stack "tmp" buffer.
> 
> This fixes the buffer size and adds a comment explaining how many bytes
> need to be allocated per record.
> 
> Signed-off-by: Kyle Moffett <Kyle.D.Moffett@boeing.com>
> ---

This should also submitted as separate patch (as bug fix, actually).

Best regards,

Wolfgang Denk

Patch

diff --git a/common/fdt_support.c b/common/fdt_support.c
index 6c98e5b..edcf04a 100644
--- a/common/fdt_support.c
+++ b/common/fdt_support.c
@@ -394,7 +394,7 @@  int fdt_fixup_memory_banks(void *blob, u64 start[], u64 size[], int banks)
 {
 	int err, nodeoffset;
 	int addr_cell_len, size_cell_len, len;
-	u8 tmp[banks * 8];
+	u8 tmp[banks * 16]; /* Up to 64-bit address + 64-bit size */
 	int bank;
 
 	err = fdt_check_header(blob);