Browse Source

libfdt: fix an incorrect integer promotion

UINT32_MAX is an integer of type unsigned int. UINT32_MAX + 1 overflows
unless explicitly computed as unsigned long long. This led to some
invalid addresses being treated as valid.

Cast UINT32_MAX to uint64_t explicitly.

Signed-off-by: Elvira Khabirova <e.khabirova@omp.ru>
main
Elvira Khabirova 3 years ago committed by David Gibson
parent
commit
c19a4bafa5
  1. 2
      libfdt/fdt_addresses.c

2
libfdt/fdt_addresses.c

@ -73,7 +73,7 @@ int fdt_appendprop_addrrange(void *fdt, int parent, int nodeoffset, @@ -73,7 +73,7 @@ int fdt_appendprop_addrrange(void *fdt, int parent, int nodeoffset,
/* check validity of address */
prop = data;
if (addr_cells == 1) {
if ((addr > UINT32_MAX) || ((UINT32_MAX + 1 - addr) < size))
if ((addr > UINT32_MAX) || (((uint64_t) UINT32_MAX + 1 - addr) < size))
return -FDT_ERR_BADVALUE;

fdt32_st(prop, (uint32_t)addr);

Loading…
Cancel
Save