Unverified Commit e3801d69 authored by Shaka Huang's avatar Shaka Huang Committed by GitHub

Fix overflow

`totalsize` might be a big (invalid) number so instead of checking the end address we check the size of the image.

Fix #4049
parent 336f1687
...@@ -205,12 +205,12 @@ static int find_dtb_offset(uint8_t *buf, unsigned sz) { ...@@ -205,12 +205,12 @@ static int find_dtb_offset(uint8_t *buf, unsigned sz) {
// Check that fdt_header.totalsize does not overflow kernel image size // Check that fdt_header.totalsize does not overflow kernel image size
uint32_t totalsize = fdt32_to_cpu(fdt_hdr->totalsize); uint32_t totalsize = fdt32_to_cpu(fdt_hdr->totalsize);
if (curr + totalsize > end) if (totalsize > end - curr)
continue; continue;
// Check that fdt_header.off_dt_struct does not overflow kernel image size // Check that fdt_header.off_dt_struct does not overflow kernel image size
uint32_t off_dt_struct = fdt32_to_cpu(fdt_hdr->off_dt_struct); uint32_t off_dt_struct = fdt32_to_cpu(fdt_hdr->off_dt_struct);
if (curr + off_dt_struct > end) if (off_dt_struct > end - curr)
continue; continue;
// Check that fdt_node_header.tag of first node is FDT_BEGIN_NODE // Check that fdt_node_header.tag of first node is FDT_BEGIN_NODE
......
Markdown is supported
0% or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment