summaryrefslogtreecommitdiffstats
path: root/commands
diff options
context:
space:
mode:
authorSascha Hauer <s.hauer@pengutronix.de>2021-06-24 10:52:08 +0200
committerSascha Hauer <s.hauer@pengutronix.de>2021-06-25 09:27:07 +0200
commit8d21690fa82bbc29cc34005103a2eda63eafabf3 (patch)
treed8ce8f5ed7cf851e1938b3cd96e0ae4860467f3b /commands
parent3b93bcd8db01bbe49249b59b0581b3ba375cb96b (diff)
downloadbarebox-8d21690fa82bbc29cc34005103a2eda63eafabf3.tar.gz
barebox-8d21690fa82bbc29cc34005103a2eda63eafabf3.tar.xz
fdt: Check blob size during unflattening
of_unflatten_dtb() doesn't check the size of the device tree blob passed to it. Add a size argument end add checks for the size. Some callers have no idea of the buffer size themselves, INT_MAX is passed in these cases. Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de> Link: https://lore.barebox.org/20210624085223.14616-4-s.hauer@pengutronix.de Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Diffstat (limited to 'commands')
-rw-r--r--commands/of_diff.c2
-rw-r--r--commands/of_display_timings.c2
-rw-r--r--commands/of_dump.c4
-rw-r--r--commands/of_overlay.c5
-rw-r--r--commands/oftree.c2
5 files changed, 8 insertions, 7 deletions
diff --git a/commands/of_diff.c b/commands/of_diff.c
index d9d84fd4bf..fa99fcd641 100644
--- a/commands/of_diff.c
+++ b/commands/of_diff.c
@@ -44,7 +44,7 @@ static struct device_node *get_tree(const char *filename, struct device_node *ro
if (ret)
return ERR_PTR(ret);
- node = of_unflatten_dtb(fdt);
+ node = of_unflatten_dtb(fdt, size);
free(fdt);
diff --git a/commands/of_display_timings.c b/commands/of_display_timings.c
index 27b91f311a..4e5ec223b7 100644
--- a/commands/of_display_timings.c
+++ b/commands/of_display_timings.c
@@ -83,7 +83,7 @@ static int do_of_display_timings(int argc, char *argv[])
return -EINVAL;
}
- root = of_unflatten_dtb(fdt);
+ root = of_unflatten_dtb(fdt, size);
free(fdt);
diff --git a/commands/of_dump.c b/commands/of_dump.c
index 2089c07ef7..5223ba63ad 100644
--- a/commands/of_dump.c
+++ b/commands/of_dump.c
@@ -71,7 +71,7 @@ static int do_of_dump(int argc, char *argv[])
return -errno;
}
- root = of_unflatten_dtb(fdt);
+ root = of_unflatten_dtb(fdt, size);
free(fdt);
@@ -88,7 +88,7 @@ static int do_of_dump(int argc, char *argv[])
/* create a copy of internal devicetree */
void *fdt;
fdt = of_flatten_dtb(root);
- root = of_unflatten_dtb(fdt);
+ root = of_unflatten_dtb(fdt, fdt_totalsize(fdt));
free(fdt);
diff --git a/commands/of_overlay.c b/commands/of_overlay.c
index aa4b6484ca..9a4c008efc 100644
--- a/commands/of_overlay.c
+++ b/commands/of_overlay.c
@@ -17,6 +17,7 @@ static int do_of_overlay(int argc, char *argv[])
struct fdt_header *fdt;
struct device_node *overlay;
const char *search_path = NULL;
+ size_t size;
while ((opt = getopt(argc, argv, "S:")) > 0) {
switch (opt) {
@@ -31,13 +32,13 @@ static int do_of_overlay(int argc, char *argv[])
if (argc != optind + 1)
return COMMAND_ERROR_USAGE;
- fdt = read_file(argv[optind], NULL);
+ fdt = read_file(argv[optind], &size);
if (!fdt) {
printf("cannot read %s\n", argv[optind]);
return 1;
}
- overlay = of_unflatten_dtb(fdt);
+ overlay = of_unflatten_dtb(fdt, size);
free(fdt);
if (IS_ERR(overlay))
return PTR_ERR(overlay);
diff --git a/commands/oftree.c b/commands/oftree.c
index 1d902f2830..7d4b08c9d3 100644
--- a/commands/oftree.c
+++ b/commands/oftree.c
@@ -82,7 +82,7 @@ static int do_oftree(int argc, char *argv[])
return 1;
}
- root = of_unflatten_dtb(fdt);
+ root = of_unflatten_dtb(fdt, size);
free(fdt);