]> git.sur5r.net Git - u-boot/commitdiff
fdt_support: Fix buffer overflow in fdt_fixup_memory_banks
authorKyle Moffett <Kyle.D.Moffett@boeing.com>
Wed, 23 Feb 2011 06:18:24 +0000 (06:18 +0000)
committerGerald Van Baren <gvb@unssw.com>
Mon, 18 Apr 2011 01:08:41 +0000 (21:08 -0400)
When fdt_fixup_memory_banks is called with 2-cell address and size
fields in the device-tree (IE: 64-bit address and size), then it will
overflow its on-stack "tmp" buffer.

This fixes the buffer size and adds a comment explaining how many bytes
need to be allocated per record.

Signed-off-by: Kyle Moffett <Kyle.D.Moffett@boeing.com>
Cc: Jerry Van Baren <vanbaren@cideas.com>
Acked-by: Gerald Van Baren <vanbaren@cideas.com>
common/fdt_support.c

index 6c98e5b07a47269789935160ff8912da21bd034c..edcf04a21b7353b494e418de0deadd1e54aeeb7e 100644 (file)
@@ -394,7 +394,7 @@ int fdt_fixup_memory_banks(void *blob, u64 start[], u64 size[], int banks)
 {
        int err, nodeoffset;
        int addr_cell_len, size_cell_len, len;
-       u8 tmp[banks * 8];
+       u8 tmp[banks * 16]; /* Up to 64-bit address + 64-bit size */
        int bank;
 
        err = fdt_check_header(blob);