diff options
| author | Sascha Hauer <s.hauer@pengutronix.de> | 2021-06-24 10:52:08 +0200 |
|---|---|---|
| committer | Sascha Hauer <s.hauer@pengutronix.de> | 2021-06-25 09:27:07 +0200 |
| commit | 8d21690fa82bbc29cc34005103a2eda63eafabf3 (patch) | |
| tree | d8ce8f5ed7cf851e1938b3cd96e0ae4860467f3b /common/blspec.c | |
| parent | 3b93bcd8db01bbe49249b59b0581b3ba375cb96b (diff) | |
| download | barebox-8d21690fa82bbc29cc34005103a2eda63eafabf3.tar.gz barebox-8d21690fa82bbc29cc34005103a2eda63eafabf3.tar.xz | |
fdt: Check blob size during unflattening
of_unflatten_dtb() doesn't check the size of the device tree blob
passed to it. Add a size argument end add checks for the size. Some
callers have no idea of the buffer size themselves, INT_MAX is passed
in these cases.
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Link: https://lore.barebox.org/20210624085223.14616-4-s.hauer@pengutronix.de
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Diffstat (limited to 'common/blspec.c')
| -rw-r--r-- | common/blspec.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/common/blspec.c b/common/blspec.c index ad80d7a8cd..056c0dbf7f 100644 --- a/common/blspec.c +++ b/common/blspec.c @@ -40,17 +40,18 @@ static int blspec_apply_oftree_overlay(char *file, const char *abspath, struct device_node *overlay; char *path; char *firmware_path; + size_t size; path = basprintf("%s/%s", abspath, file); - fdt = read_file(path, NULL); + fdt = read_file(path, &size); if (!fdt) { pr_warn("unable to read \"%s\"\n", path); ret = -EINVAL; goto out; } - overlay = of_unflatten_dtb(fdt); + overlay = of_unflatten_dtb(fdt, size); free(fdt); if (IS_ERR(overlay)) { ret = PTR_ERR(overlay); @@ -490,7 +491,7 @@ static bool entry_is_of_compatible(struct blspec_entry *entry) goto out; } - root = of_unflatten_dtb(fdt); + root = of_unflatten_dtb(fdt, size); if (IS_ERR(root)) { ret = false; root = NULL; |