summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorJon Nalley <lists@bluebot.org>2014-02-26 11:32:21 -0500
committerTom Rini <trini@ti.com>2014-06-19 11:18:42 -0400
commitaf67b25250e5dd636a844d869bba8ce698422145 (patch)
treef1e25e955326b5670fc39f08d39047cc3a78e249
parentf1329c900374f9efd6a27658dbebb104648f1a06 (diff)
downloadu-boot-imx-af67b25250e5dd636a844d869bba8ce698422145.zip
u-boot-imx-af67b25250e5dd636a844d869bba8ce698422145.tar.gz
u-boot-imx-af67b25250e5dd636a844d869bba8ce698422145.tar.bz2
libfdt: Fix segfault when calling fit_check_format() on corrupt FIT images
It has been observed that fit_check_format() will fail when passed a corrupt FIT image. This was tracked down to _fdt_string_eq(): return (strlen(p) == len) && (memcmp(p, s, len) == 0); In the case of a corrupt FIT image one can't depend on 'p' being NULL terminated. I changed it to use strnlen() to fix the issue. Signed-off-by: Tom Rini <trini@ti.com>
-rw-r--r--lib/libfdt/fdt_ro.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/lib/libfdt/fdt_ro.c b/lib/libfdt/fdt_ro.c
index f2154e8..36af043 100644
--- a/lib/libfdt/fdt_ro.c
+++ b/lib/libfdt/fdt_ro.c
@@ -44,7 +44,7 @@ static int _fdt_string_eq(const void *fdt, int stroffset,
{
const char *p = fdt_string(fdt, stroffset);
- return (strlen(p) == len) && (memcmp(p, s, len) == 0);
+ return (strnlen(p, len + 1) == len) && (memcmp(p, s, len) == 0);
}
int fdt_get_mem_rsv(const void *fdt, int n, uint64_t *address, uint64_t *size)