From: Kyle Moffett Date: Wed, 23 Feb 2011 06:18:24 +0000 (+0000) Subject: fdt_support: Fix buffer overflow in fdt_fixup_memory_banks X-Git-Tag: v2011.06-rc1~144^2 X-Git-Url: https://git.sur5r.net/?a=commitdiff_plain;h=d13ffa66aff1d9aed9081986492fb74c1a61a4a9;p=u-boot fdt_support: Fix buffer overflow in fdt_fixup_memory_banks When fdt_fixup_memory_banks is called with 2-cell address and size fields in the device-tree (IE: 64-bit address and size), then it will overflow its on-stack "tmp" buffer. This fixes the buffer size and adds a comment explaining how many bytes need to be allocated per record. Signed-off-by: Kyle Moffett Cc: Jerry Van Baren Acked-by: Gerald Van Baren --- diff --git a/common/fdt_support.c b/common/fdt_support.c index 6c98e5b07a..edcf04a21b 100644 --- a/common/fdt_support.c +++ b/common/fdt_support.c @@ -394,7 +394,7 @@ int fdt_fixup_memory_banks(void *blob, u64 start[], u64 size[], int banks) { int err, nodeoffset; int addr_cell_len, size_cell_len, len; - u8 tmp[banks * 8]; + u8 tmp[banks * 16]; /* Up to 64-bit address + 64-bit size */ int bank; err = fdt_check_header(blob);