From 66fb1406568c7e582dbd5ffd8f3b8a8350146960 Mon Sep 17 00:00:00 2001 From: David Gibson Date: Tue, 17 Mar 2020 16:18:57 +0100 Subject: [PATCH] libfdt: Fix undefined behaviour in fdt_offset_ptr() Using pointer arithmetic to generate a pointer outside a known object is, technically, undefined behaviour in C. Unfortunately, we were using that in fdt_offset_ptr() to detect overflows. To fix this we need to do our bounds / overflow checking on the offsets before constructing pointers from them. Reported-by: David Binderman Signed-off-by: David Gibson [upstream commit d0b3ab0a0f46ac929b4713da46f7fdcd893dd3bd] Signed-off-by: Jan Beulich Acked-by: Julien Grall --- xen/common/libfdt/fdt.c | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/xen/common/libfdt/fdt.c b/xen/common/libfdt/fdt.c index d02f4bf5f3..bbc77177d9 100644 --- a/xen/common/libfdt/fdt.c +++ b/xen/common/libfdt/fdt.c @@ -74,18 +74,19 @@ int fdt_check_header(const void *fdt) const void *fdt_offset_ptr(const void *fdt, int offset, unsigned int len) { - const char *p; + unsigned absoffset = offset + fdt_off_dt_struct(fdt); + + if ((absoffset < offset) + || ((absoffset + len) < absoffset) + || (absoffset + len) > fdt_totalsize(fdt)) + return NULL; if (fdt_version(fdt) >= 0x11) if (((offset + len) < offset) || ((offset + len) > fdt_size_dt_struct(fdt))) return NULL; - p = _fdt_offset_ptr(fdt, offset); - - if (p + len < p) - return NULL; - return p; + return _fdt_offset_ptr(fdt, offset); } uint32_t fdt_next_tag(const void *fdt, int startoffset, int *nextoffset) -- 2.30.2