diff options
| author | David Gibson <david@gibson.dropbear.id.au> | 2018-03-09 23:28:56 +1100 |
|---|---|---|
| committer | David Gibson <david@gibson.dropbear.id.au> | 2018-06-07 11:48:20 +1000 |
| commit | d5db5382c5e583d184e4484662eb87f1999d4a46 (patch) | |
| tree | b464c3bd120fd6aac9abaa4b09f349658bb5e889 /tests/Makefile.tests | |
| parent | 719d582e98ec9c696c3e3c74e6efb357fd2168f8 (diff) | |
| download | dtc-d5db5382c5e583d184e4484662eb87f1999d4a46.zip dtc-d5db5382c5e583d184e4484662eb87f1999d4a46.tar.gz dtc-d5db5382c5e583d184e4484662eb87f1999d4a46.tar.bz2 | |
libfdt: Safer access to memory reservations
fdt_num_mem_rsv() and fdt_get_mem_rsv() currently don't sanity check their
parameters, or the memory reserve section offset in the header. That means
that on a corrupted blob they could access outside of the range of memory
that they should.
This improves their safety checking, meaning they shouldn't access outside
the blob's bounds, even if its contents are badly corrupted.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Simon Glass <sjg@chromium.org>
Diffstat (limited to 'tests/Makefile.tests')
| -rw-r--r-- | tests/Makefile.tests | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/tests/Makefile.tests b/tests/Makefile.tests index 97f7f8d..489886f 100644 --- a/tests/Makefile.tests +++ b/tests/Makefile.tests @@ -29,7 +29,7 @@ LIB_TESTS_L = get_mem_rsv \ check_path check_header LIB_TESTS = $(LIB_TESTS_L:%=$(TESTS_PREFIX)%) -LIBTREE_TESTS_L = truncated_property truncated_string +LIBTREE_TESTS_L = truncated_property truncated_string truncated_memrsv LIBTREE_TESTS = $(LIBTREE_TESTS_L:%=$(TESTS_PREFIX)%) DL_LIB_TESTS_L = asm_tree_dump value-labels |