diff --git a/lib/libfdt/fdt.c b/lib/libfdt/fdt.c index 96017a15a27aed38697c0d0d23b642082dd6d8b1..2055734012a1009438adf10b2d2e232f5b647c3d 100644 --- a/lib/libfdt/fdt.c +++ b/lib/libfdt/fdt.c @@ -35,18 +35,19 @@ int fdt_check_header(const void *fdt) const void *fdt_offset_ptr(const void *fdt, int offset, unsigned int len) { - const char *p; + unsigned absoffset = offset + fdt_off_dt_struct(fdt); + + if ((absoffset < offset) + || ((absoffset + len) < absoffset) + || (absoffset + len) > fdt_totalsize(fdt)) + return NULL; if (fdt_version(fdt) >= 0x11) if (((offset + len) < offset) || ((offset + len) > fdt_size_dt_struct(fdt))) return NULL; - p = _fdt_offset_ptr(fdt, offset); - - if (p + len < p) - return NULL; - return p; + return _fdt_offset_ptr(fdt, offset); } uint32_t fdt_next_tag(const void *fdt, int startoffset, int *nextoffset)