diff options
| author | Kyle Moffett <Kyle.D.Moffett@boeing.com> | 2011-02-23 06:18:24 +0000 |
|---|---|---|
| committer | Gerald Van Baren <gvb@unssw.com> | 2011-04-17 21:08:41 -0400 |
| commit | d13ffa66aff1d9aed9081986492fb74c1a61a4a9 (patch) | |
| tree | adae07a5ad3c6ba229830445e8a41208416e267c /common | |
| parent | 73e5476e1edf1b860dbd9b5fc21ef32ac1b551ba (diff) | |
fdt_support: Fix buffer overflow in fdt_fixup_memory_banks
When fdt_fixup_memory_banks is called with 2-cell address and size
fields in the device-tree (IE: 64-bit address and size), then it will
overflow its on-stack "tmp" buffer.
This fixes the buffer size and adds a comment explaining how many bytes
need to be allocated per record.
Signed-off-by: Kyle Moffett <Kyle.D.Moffett@boeing.com>
Cc: Jerry Van Baren <vanbaren@cideas.com>
Acked-by: Gerald Van Baren <vanbaren@cideas.com>
Diffstat (limited to 'common')
| -rw-r--r-- | common/fdt_support.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/common/fdt_support.c b/common/fdt_support.c index 6c98e5b07..edcf04a21 100644 --- a/common/fdt_support.c +++ b/common/fdt_support.c @@ -394,7 +394,7 @@ int fdt_fixup_memory_banks(void *blob, u64 start[], u64 size[], int banks) { int err, nodeoffset; int addr_cell_len, size_cell_len, len; - u8 tmp[banks * 8]; + u8 tmp[banks * 16]; /* Up to 64-bit address + 64-bit size */ int bank; err = fdt_check_header(blob); |