Hi Jan, On 13/03/2020 07:35, Jan Beulich wrote:
Along the lines of commit d0b3ab0a0f46 ("libfdt: Fix undefined behaviour in fdt_offset_ptr()"), _fdt_splice() similarly may not use pointer arithmetic to do overflow checks.[upstream commit 73d6e9ecb4179b510408bc526240f829262df361] Signed-off-by: Jan Beulich <[email protected]>
Acked-by: Julien Grall <[email protected]> Cheers,
--- a/xen/common/libfdt/fdt_rw.c +++ b/xen/common/libfdt/fdt_rw.c @@ -87,7 +87,7 @@ static int _fdt_rw_check_header(void *fd return err; \ }-static inline int _fdt_data_size(void *fdt)+static inline unsigned int _fdt_data_size(void *fdt) { return fdt_off_dt_strings(fdt) + fdt_size_dt_strings(fdt); } @@ -95,13 +95,14 @@ static inline int _fdt_data_size(void *f static int _fdt_splice(void *fdt, void *splicepoint, int oldlen, int newlen) { char *p = splicepoint; - char *end = (char *)fdt + _fdt_data_size(fdt); + unsigned int dsize = _fdt_data_size(fdt); + size_t soff = p - (char *)fdt;- if (((p + oldlen) < p) || ((p + oldlen) > end))+ if (oldlen < 0 || soff + oldlen < soff || soff + oldlen > dsize) return -FDT_ERR_BADOFFSET; - if ((end - oldlen + newlen) > ((char *)fdt + fdt_totalsize(fdt))) + if (dsize - oldlen + newlen > fdt_totalsize(fdt)) return -FDT_ERR_NOSPACE; - memmove(p + newlen, p + oldlen, end - p - oldlen); + memmove(p + newlen, p + oldlen, ((char *)fdt + dsize) - (p + oldlen)); return 0; }
-- Julien Grall _______________________________________________ Xen-devel mailing list [email protected] https://lists.xenproject.org/mailman/listinfo/xen-devel
