In fdt_rw.c, -FDT_ERR_BADOFFSET is returned when either the sum of the old length and the splice point are less than the splice point, or when the sum of the old length and the splice point exceed the end of the pointer. Adding an int and a pointer may result in a pointer overflow, an undefined behavior, which means that the result of this if statement can't be recovered from. Checking if the old length exceeds the end of the pointer minus the pointer is a much safer check.
Signed-off-by: Elijah Conners business@elijahpepe.com --- scripts/dtc/libfdt/fdt_rw.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/scripts/dtc/libfdt/fdt_rw.c b/scripts/dtc/libfdt/fdt_rw.c index 2eb2b38703..672b74ae7a 100644 --- a/scripts/dtc/libfdt/fdt_rw.c +++ b/scripts/dtc/libfdt/fdt_rw.c @@ -58,7 +58,7 @@ static int fdt_splice_(void *fdt, void *splicepoint, int oldlen, int newlen) char *p = splicepoint; char *end = (char *)fdt + fdt_data_size_(fdt);
- if (((p + oldlen) < p) || ((p + oldlen) > end)) + if (oldlen >= (end - p)) return -FDT_ERR_BADOFFSET; if ((p < (char *)fdt) || ((end - oldlen + newlen) < (char *)fdt)) return -FDT_ERR_BADOFFSET;