commit e86d2fc3878a75041a768c53b09e8133e7147daf
author Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Wed Aug 03 23:05:05 2022 +0000
committer Android Build Coastguard Worker <android-build-coastguard-worker@google.com> Wed Aug 03 23:05:05 2022 +0000
tree c64b25f681931b1587870e8e38ba7408874e6dde
parent 26575bd9bee4cdda4227226675bc742e8cc5b5fd
parent 0e783e26f75c08e421467ca4a6c21ff2589cd2fa

Snap for 8903759 from 0e783e26f75c08e421467ca4a6c21ff2589cd2fa to tm-d1-release

Change-Id: I1ccee0b46160bc660bc6962a732f4e4a234683d0

libfdt/fdt.c

diff --git a/libfdt/fdt.c b/libfdt/fdt.c
index c28fcc1..3f9cf3e 100644
--- a/libfdt/fdt.c
+++ b/libfdt/fdt.c
@@ -176,12 +176,20 @@
 		break;
 
 	case FDT_PROP:
-		lenp = fdt_offset_ptr(fdt, offset, sizeof(*lenp));
+		lenp = fdt_offset_ptr(fdt, offset, sizeof(struct fdt_property) - FDT_TAGSIZE);
 		if (!can_assume(VALID_DTB) && !lenp)
 			return FDT_END; /* premature end */
-		/* skip-name offset, length and value */
-		offset += sizeof(struct fdt_property) - FDT_TAGSIZE
-			+ fdt32_to_cpu(*lenp);
+
+		/* skip name offset, length */
+		offset += sizeof(struct fdt_property) - FDT_TAGSIZE;
+
+		if (!can_assume(VALID_DTB)
+		    && !fdt_offset_ptr(fdt, offset, fdt32_to_cpu(*lenp)))
+			return FDT_END; /* premature end */
+
+		/* skip value */
+		offset += fdt32_to_cpu(*lenp);
+
 		if (!can_assume(LATEST) &&
 		    fdt_version(fdt) < 0x10 && fdt32_to_cpu(*lenp) >= 8 &&
 		    ((offset - fdt32_to_cpu(*lenp)) % 8) != 0)
@@ -197,7 +205,8 @@
 		return FDT_END;
 	}
 
-	if (!fdt_offset_ptr(fdt, startoffset, offset - startoffset))
+	if (!can_assume(VALID_DTB) && (offset <= startoffset
+	    || !fdt_offset_ptr(fdt, startoffset, offset - startoffset)))
 		return FDT_END; /* premature end */
 
 	*nextoffset = FDT_TAGALIGN(offset);