libfdt: fix fdt_check_full buffer overrun
fdt_check_header assumes that its argument points to a complete header and can read data beyond the FDT_V1_SIZE bytes which fdt_check_full can provide. fdt_header_size can safely return a header size with FDT_V1_SIZE bytes available and will return a usable value even for a corrupted header. Signed-off-by:Patrick Oppenlander <patrick.oppenlander@gmail.com> Message-Id: <20200709041451.338548-1-patrick.oppenlander@gmail.com> Signed-off-by:
David Gibson <david@gibson.dropbear.id.au>
Loading
Please sign in to comment