Fix an overflow case in fdt_offset_ptr() detected by GCC 4.3.

[J-u-boot.git] / libfdt / fdt.c

diff --git a/libfdt/fdt.c b/libfdt/fdt.c
index cfa1989d8e544c53cb87f67d4a953b545cf2bf3e..a59a518b0e2e1684d976c7e36e37063e8bce2579 100644 (file)
--- a/libfdt/fdt.c
+++ b/libfdt/fdt.c
@@ -67,7 +67,7 @@ int fdt_check_header(const void *fdt)
                        return -FDT_ERR_BADVERSION;
                if (fdt_last_comp_version(fdt) > FDT_LAST_SUPPORTED_VERSION)
                        return -FDT_ERR_BADVERSION;
-       } else if (fdt_magic(fdt) == SW_MAGIC) {
+       } else if (fdt_magic(fdt) == FDT_SW_MAGIC) {
                /* Unfinished sequential-write blob */
                if (fdt_size_dt_struct(fdt) == 0)
                        return -FDT_ERR_BADSTATE;
@@ -78,9 +78,9 @@ int fdt_check_header(const void *fdt)
        return 0;
 }
 
-const void *fdt_offset_ptr(const void *fdt, int offset, int len)
+const void *fdt_offset_ptr(const void *fdt, int offset, unsigned int len)
 {
-       const void *p;
+       const char *p;
 
        if (fdt_version(fdt) >= 0x11)
                if (((offset + len) < offset)
@@ -128,21 +128,28 @@ uint32_t fdt_next_tag(const void *fdt, int offset, int *nextoffset)
        }
 
        if (nextoffset)
-               *nextoffset = ALIGN(offset, FDT_TAGSIZE);
+               *nextoffset = FDT_TAGALIGN(offset);
 
        return tag;
 }
 
+int _fdt_check_node_offset(const void *fdt, int offset)
+{
+       if ((offset < 0) || (offset % FDT_TAGSIZE)
+           || (fdt_next_tag(fdt, offset, &offset) != FDT_BEGIN_NODE))
+               return -FDT_ERR_BADOFFSET;
+
+       return offset;
+}
+
 int fdt_next_node(const void *fdt, int offset, int *depth)
 {
        int nextoffset = 0;
        uint32_t tag;
 
-       if (offset >= 0) {
-               tag = fdt_next_tag(fdt, offset, &nextoffset);
-               if (tag != FDT_BEGIN_NODE)
-                       return -FDT_ERR_BADOFFSET;
-       }
+       if (offset >= 0)
+               if ((nextoffset = _fdt_check_node_offset(fdt, offset)) < 0)
+                       return nextoffset;
 
        do {
                offset = nextoffset;
@@ -181,14 +188,14 @@ const char *_fdt_find_string(const char *strtab, int tabsize, const char *s)
        const char *p;
 
        for (p = strtab; p <= last; p++)
-               if (memeq(p, s, len))
+               if (memcmp(p, s, len) == 0)
                        return p;
        return NULL;
 }
 
 int fdt_move(const void *fdt, void *buf, int bufsize)
 {
-       CHECK_HEADER(fdt);
+       FDT_CHECK_HEADER(fdt);
 
        if (fdt_totalsize(fdt) > bufsize)
                return -FDT_ERR_NOSPACE;