kernel
/
dtc
mirror of https://git.kernel.org/pub/scm/utils/dtc/dtc.git
1
0
Fork 0
Code Issues Projects Releases Wiki Activity

fdtdump.c: make sure size_t argument to memchr is always unsigned. 

CID 132817 (#1 of 1): Integer overflowed argument (INTEGER_OVERFLOW)
15. overflow_sink: Overflowed or truncated value (or a value computed from an overflowed or truncated value) endp - p - 4L used as critical argument to function.

Signed-off-by: Jean-Christophe Dubois <jcd@tribudubois.net>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
main
Jean-Christophe Dubois 2016-07-13 02:31:13 +02:00 committed by David Gibson
parent 44a59713cf
commit e24d39a024
1 changed files with 6 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
fdtdump.c
View File

@ -15,6 +15,8 @@


#include "util.h" #include "util.h"


#define FDT_MAGIC_SIZE 4

#define ALIGN(x, a) (((x) + ((a) - 1)) & ~((a) - 1)) #define ALIGN(x, a) (((x) + ((a) - 1)) & ~((a) - 1))
#define PALIGN(p, a) ((void *)(ALIGN((unsigned long)(p), (a)))) #define PALIGN(p, a) ((void *)(ALIGN((unsigned long)(p), (a))))
#define GET_CELL(p) (p += 4, *((const uint32_t *)(p-4))) #define GET_CELL(p) (p += 4, *((const uint32_t *)(p-4)))
@ -188,15 +190,15 @@ int main(int argc, char *argv[])


/* try and locate an embedded fdt in a bigger blob */ /* try and locate an embedded fdt in a bigger blob */
if (scan) { if (scan) {
unsigned char smagic[4]; unsigned char smagic[FDT_MAGIC_SIZE];
char *p = buf; char *p = buf;
char *endp = buf + len; char *endp = buf + len;


fdt_set_magic(smagic, FDT_MAGIC); fdt_set_magic(smagic, FDT_MAGIC);


/* poor man's memmem */ /* poor man's memmem */
while (true) { while ((endp - p) >= FDT_MAGIC_SIZE) {
p = memchr(p, smagic[0], endp - p - 4); p = memchr(p, smagic[0], endp - p - FDT_MAGIC_SIZE);
if (!p) if (!p)
break; break;
if (fdt_magic(p) == FDT_MAGIC) { if (fdt_magic(p) == FDT_MAGIC) {
@ -215,7 +217,7 @@ int main(int argc, char *argv[])
} }
++p; ++p;
} }
if (!p) if (!p || ((endp - p) < FDT_MAGIC_SIZE))
die("%s: could not locate fdt magic\n", file); die("%s: could not locate fdt magic\n", file);
printf("%s: found fdt at offset %#zx\n", file, p - buf); printf("%s: found fdt at offset %#zx\n", file, p - buf);
buf = p; buf = p;