tree 1c498c162608ead00ad8e841967b426df45293b4
parent b06e55c88b9b922ff7e25cd62a4709b65524f0fc
author Anton Blanchard <anton@samba.org> 1451771015 +1100
committer David Gibson <david@gibson.dropbear.id.au> 1455804526 +1100

Catch unsigned 32bit overflow when parsing flattened device tree offsets

We have a couple of checks of the form:

    if (offset+size > totalsize)
        die();

We need to check that offset+size doesn't overflow, otherwise the check
will pass, and we may access past totalsize.

Found with AFL.

Signed-off-by: Anton Blanchard <anton@samba.org>
[Added a testcase]
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>