[automerger skipped] Fix integer wrap sanitisation. am: 61e10c9c53 am: 5a3e448a22 am: d3f1c05623 am: aa22bcd1bc -s ours am: b8922879f6 -s ours
am skip reason: skipped by user mikemcternan
Original change: https://googleplex-android-review.googlesource.com/c/platform/external/dtc/+/19606334
Change-Id: I0e39e4764906289405406039a8a8f3fa7d02e004
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>
diff --git a/libfdt/fdt.c b/libfdt/fdt.c
index 82521b7..17ac7d6 100644
--- a/libfdt/fdt.c
+++ b/libfdt/fdt.c
@@ -180,12 +180,20 @@
break;
case FDT_PROP:
- lenp = fdt_offset_ptr(fdt, offset, sizeof(*lenp));
+ lenp = fdt_offset_ptr(fdt, offset, sizeof(struct fdt_property) - FDT_TAGSIZE);
if (!can_assume(VALID_DTB) && !lenp)
return FDT_END; /* premature end */
- /* skip-name offset, length and value */
- offset += sizeof(struct fdt_property) - FDT_TAGSIZE
- + fdt32_to_cpu(*lenp);
+
+ /* skip name offset, length */
+ offset += sizeof(struct fdt_property) - FDT_TAGSIZE;
+
+ if (!can_assume(VALID_DTB)
+ && !fdt_offset_ptr(fdt, offset, fdt32_to_cpu(*lenp)))
+ return FDT_END; /* premature end */
+
+ /* skip value */
+ offset += fdt32_to_cpu(*lenp);
+
if (!can_assume(LATEST) &&
fdt_version(fdt) < 0x10 && fdt32_to_cpu(*lenp) >= 8 &&
((offset - fdt32_to_cpu(*lenp)) % 8) != 0)
@@ -201,7 +209,8 @@
return FDT_END;
}
- if (!fdt_offset_ptr(fdt, startoffset, offset - startoffset))
+ if (!can_assume(VALID_DTB) && (offset <= startoffset
+ || !fdt_offset_ptr(fdt, startoffset, offset - startoffset)))
return FDT_END; /* premature end */
*nextoffset = FDT_TAGALIGN(offset);