openwrt/package/boot/uboot-d1/patches/0022-fdt-Fix-bounds-check-in-devfdt_get_addr_index.patch
Zoltan HERPAI d41d9befb9 uboot-d1: add bootloader for upcoming d1 target
Add u-boot bootloader based on 2023.01 to support D1-based boards, currently:

 - Dongshan Nezha STU
 - LicheePi RV Dock
 - MangoPi MQ-Pro
 - Nezha D1

Signed-off-by: Zoltan HERPAI <wigyori@uid0.hu>
2024-02-29 16:50:20 +01:00

29 lines
1.0 KiB
Diff

From 0e4edc3a01f179337bb0bd0d31855dbce338a23e Mon Sep 17 00:00:00 2001
From: Samuel Holland <samuel@sholland.org>
Date: Sun, 30 Oct 2022 14:53:45 -0500
Subject: [PATCH 22/90] fdt: Fix bounds check in devfdt_get_addr_index
reg must contain enough cells for the entire next address/size pair
after skipping `index` pairs. The previous code allows an out-of-bounds
read when na + ns > 1.
Series-to: Simon Glass <sjg@chromium.org>
Fixes: 69b41388ba45 ("dm: core: Add a new api to get indexed device address")
Signed-off-by: Samuel Holland <samuel@sholland.org>
---
drivers/core/fdtaddr.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- a/drivers/core/fdtaddr.c
+++ b/drivers/core/fdtaddr.c
@@ -43,7 +43,7 @@ fdt_addr_t devfdt_get_addr_index(const s
}
reg = fdt_getprop(gd->fdt_blob, offset, "reg", &len);
- if (!reg || (len <= (index * sizeof(fdt32_t) * (na + ns)))) {
+ if (!reg || (len < ((index + 1) * sizeof(fdt32_t) * (na + ns)))) {
debug("Req index out of range\n");
return FDT_ADDR_T_NONE;
}