| Message ID | 1298477904-21221-1-git-send-email-Kyle.D.Moffett@boeing.com |
|---|---|
| State | Accepted |
| Delegated to: | Jerry Van Baren |
| Headers | show |
Dear Wolfgang, Can you apply this patch for me? Otherwise I'll apply it to my repo and send a pull request. Acked-by: Gerald Van Baren <vanbaren@cideas.com> Thanks, gvb On 02/23/2011 11:18 AM, Kyle Moffett wrote: > When fdt_fixup_memory_banks is called with 2-cell address and size > fields in the device-tree (IE: 64-bit address and size), then it will > overflow its on-stack "tmp" buffer. > > This fixes the buffer size and adds a comment explaining how many bytes > need to be allocated per record. > > Signed-off-by: Kyle Moffett<Kyle.D.Moffett@boeing.com> > Cc: Jerry Van Baren<vanbaren@cideas.com> > --- > Changelog: > v2: Resubmitted separately from the other HWW-1U-1A changes. > > common/fdt_support.c | 2 +- > 1 files changed, 1 insertions(+), 1 deletions(-) > > diff --git a/common/fdt_support.c b/common/fdt_support.c > index 6c98e5b..edcf04a 100644 > --- a/common/fdt_support.c > +++ b/common/fdt_support.c > @@ -394,7 +394,7 @@ int fdt_fixup_memory_banks(void *blob, u64 start[], u64 size[], int banks) > { > int err, nodeoffset; > int addr_cell_len, size_cell_len, len; > - u8 tmp[banks * 8]; > + u8 tmp[banks * 16]; /* Up to 64-bit address + 64-bit size */ > int bank; > > err = fdt_check_header(blob);
On 02/23/2011 11:18 AM, Kyle Moffett wrote: > When fdt_fixup_memory_banks is called with 2-cell address and size > fields in the device-tree (IE: 64-bit address and size), then it will > overflow its on-stack "tmp" buffer. > > This fixes the buffer size and adds a comment explaining how many bytes > need to be allocated per record. > > Signed-off-by: Kyle Moffett<Kyle.D.Moffett@boeing.com> > Cc: Jerry Van Baren<vanbaren@cideas.com> > --- > Changelog: > v2: Resubmitted separately from the other HWW-1U-1A changes. Applied to u-boot-fdt, thanks. gvb
diff --git a/common/fdt_support.c b/common/fdt_support.c index 6c98e5b..edcf04a 100644 --- a/common/fdt_support.c +++ b/common/fdt_support.c @@ -394,7 +394,7 @@ int fdt_fixup_memory_banks(void *blob, u64 start[], u64 size[], int banks) { int err, nodeoffset; int addr_cell_len, size_cell_len, len; - u8 tmp[banks * 8]; + u8 tmp[banks * 16]; /* Up to 64-bit address + 64-bit size */ int bank; err = fdt_check_header(blob);
When fdt_fixup_memory_banks is called with 2-cell address and size fields in the device-tree (IE: 64-bit address and size), then it will overflow its on-stack "tmp" buffer. This fixes the buffer size and adds a comment explaining how many bytes need to be allocated per record. Signed-off-by: Kyle Moffett <Kyle.D.Moffett@boeing.com> Cc: Jerry Van Baren <vanbaren@cideas.com> --- Changelog: v2: Resubmitted separately from the other HWW-1U-1A changes. common/fdt_support.c | 2 +- 1 files changed, 1 insertions(+), 1 deletions(-)