diff options
author | David Gibson <david@gibson.dropbear.id.au> | 2018-03-09 23:28:56 +1100 |
---|---|---|
committer | David Gibson <david@gibson.dropbear.id.au> | 2018-06-07 11:48:20 +1000 |
commit | d5db5382c5e583d184e4484662eb87f1999d4a46 (patch) | |
tree | b464c3bd120fd6aac9abaa4b09f349658bb5e889 /tests/testdata.h | |
parent | 719d582e98ec9c696c3e3c74e6efb357fd2168f8 (diff) | |
download | dtc-d5db5382c5e583d184e4484662eb87f1999d4a46.zip dtc-d5db5382c5e583d184e4484662eb87f1999d4a46.tar.gz dtc-d5db5382c5e583d184e4484662eb87f1999d4a46.tar.bz2 |
libfdt: Safer access to memory reservations
fdt_num_mem_rsv() and fdt_get_mem_rsv() currently don't sanity check their
parameters, or the memory reserve section offset in the header. That means
that on a corrupted blob they could access outside of the range of memory
that they should.
This improves their safety checking, meaning they shouldn't access outside
the blob's bounds, even if its contents are badly corrupted.
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Tested-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Alexey Kardashevskiy <aik@ozlabs.ru>
Reviewed-by: Simon Glass <sjg@chromium.org>
Diffstat (limited to 'tests/testdata.h')
-rw-r--r-- | tests/testdata.h | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/tests/testdata.h b/tests/testdata.h index b257011..68dcbac 100644 --- a/tests/testdata.h +++ b/tests/testdata.h @@ -48,4 +48,5 @@ extern struct fdt_header bad_node_format; extern struct fdt_header bad_prop_char; extern struct fdt_header ovf_size_strings; extern struct fdt_header truncated_string; +extern struct fdt_header truncated_memrsv; #endif /* ! __ASSEMBLY */ |