tree 9a37858d7e0fea7d58c89a258c7ca346b3511fa5
parent f58799be130e27cc729cb2d45566daa0bb3b8605
author Courtney Cavin <courtney.cavin@sonymobile.com> 1449016990 -0800
committer David Gibson <david@gibson.dropbear.id.au> 1449022271 +1100

libfdt: check for potential overrun in _fdt_splice()

This patch catches the conditions where:
 - 'splicepoint' is set to a point outside of [ fdt, fdt_totalsize(fdt) )
 - 'newlen' is negative, or 'splicepoint' plus 'newlen' results in overflow

Either of these cases can be caused by math which overflows in calling
functions, or by sizes specified through dynamic means.

Signed-off-by: Courtney Cavin <courtney.cavin@sonymobile.com>
Signed-off-by: Bjorn Andersson <bjorn.andersson@sonymobile.com>