X-Git-Url: https://git.sur5r.net/?a=blobdiff_plain;f=lib%2Flibfdt%2Ffdt.c;h=2055734012a1009438adf10b2d2e232f5b647c3d;hb=f1cc97764be4383d2aeb56d5ba5415439a1d5c97;hp=96017a15a27aed38697c0d0d23b642082dd6d8b1;hpb=09849f4a7779a247be8af5cfae44f7aad30e1222;p=u-boot

diff --git a/lib/libfdt/fdt.c b/lib/libfdt/fdt.c
index 96017a15a2..2055734012 100644
--- a/lib/libfdt/fdt.c
+++ b/lib/libfdt/fdt.c
@@ -35,18 +35,19 @@ int fdt_check_header(const void *fdt)
 
 const void *fdt_offset_ptr(const void *fdt, int offset, unsigned int len)
 {
-	const char *p;
+	unsigned absoffset = offset + fdt_off_dt_struct(fdt);
+
+	if ((absoffset < offset)
+	    || ((absoffset + len) < absoffset)
+	    || (absoffset + len) > fdt_totalsize(fdt))
+		return NULL;
 
 	if (fdt_version(fdt) >= 0x11)
 		if (((offset + len) < offset)
 		    || ((offset + len) > fdt_size_dt_struct(fdt)))
 			return NULL;
 
-	p = _fdt_offset_ptr(fdt, offset);
-
-	if (p + len < p)
-		return NULL;
-	return p;
+	return _fdt_offset_ptr(fdt, offset);
 }
 
 uint32_t fdt_next_tag(const void *fdt, int startoffset, int *nextoffset)