[PATCH] drivers: of: fix possible overflow

[Abdelrahman Youssef]

while parsing the fdt header, the name of the begining node marked by
FDT_BEGIN_NODE that is part of the struct block moves out of the block
that results in heap-overflow.

So this patch checks if the length of name (maxlen) + the offset of
the struct block exceeds the size of the whole block.

Signed-off-by: Abdelrahman Youssef <abdelrahmanyossef12 at gmail.com>
---
 drivers/of/fdt.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 2c3ea31394..7dc8ee2529 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -210,6 +210,11 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
 			maxlen = (unsigned long)fdt + f.off_dt_struct +
 				f.size_dt_struct - (unsigned long)name;
 
+			if (maxlen + f.off_dt_struct > f.size_dt_struct) {
+				ret = -ESPIPE;
+				goto err;
+			}
+
 			len = strnlen(name, maxlen + 1);
 			if (len > maxlen) {
 				ret = -ESPIPE;
-- 
2.43.0