Eric Lee / smarc-uboot

08 Aug, 2019

1 commit

23 Mar, 2019

1 commit

  • e63bf1b13   common: image-android-dt: Fix out-of-bounds access ... Browse Code »

    Currently, 'dtimg' allows users to check indexes equal to
    dt_entry_count [1]. Forbid that [2].

    [1] Behavior w/o the patch:

    => ext2load mmc 0:1 0x48000000 dtb.img
    105695 bytes read in 5 ms (20.2 MiB/s)

    => dtimg dump 0x48000000
    dt_table_header:
    magic = d7b7ab1e
    total_size = 105695
    header_size = 32
    dt_entry_size = 32
    dt_entry_count = 2
    dt_entries_offset = 32
    page_size = 4096
    version = 0
    dt_table_entry[0]:
    dt_size = 105599
    dt_offset = 96
    id = 0b779520
    rev = 00000000
    custom[0] = 00000000
    custom[1] = 00000000
    custom[2] = 00000000
    custom[3] = 00000000
    (FDT)size = 105599
    (FDT)compatible = shimafuji,kingfisher
    dt_table_entry[1]:
    dt_size = 105599
    dt_offset = 96
    id = 0b779530
    rev = 00000000
    custom[0] = 00000000
    custom[1] = 00000000
    custom[2] = 00000000
    custom[3] = 00000000
    (FDT)size = 105599
    (FDT)compatible = shimafuji,kingfisher

    => dtimg size 0x48000000 0 z; print z
    z=19c7f
    => dtimg size 0x48000000 1 z; print z
    z=19c7f
    => dtimg size 0x48000000 2 z; print z
    z=d00dfeed
    => dtimg size 0x48000000 3 z
    Error: index > dt_entry_count (3 > 2)

    [2] Behavior with the patch:

    => dtimg size 0x48000000 0 z; print z
    z=19c7f
    => dtimg size 0x48000000 1 z; print z
    z=19c7f
    => dtimg size 0x48000000 2 z
    Error: index >= dt_entry_count (2 >= 2)

    Fixes: c04473345712 ("common: Add support for Android DT image")
    Signed-off-by: Eugeniu Rosca

    Eugeniu Rosca
     

20 Aug, 2018

1 commit

  • c04473345   common: Add support for Android DT image ... Browse Code »
    14

    Android documentation recommends new image format for storing DTB/DTBO
    files: [1]. To support that format, this patch adds helper functions for
    Android DTB/DTBO format. In image-android-dt.* files you can find helper
    functions to work with Android DT image format, such us routines for:
    - printing the dump of image structure
    - getting the address and size of desired dtb/dtbo file

    This patch uses dt_table.h file, that was added in commit 643cefa4d848
    ("Import Android's dt_table.h for DT image format") by Alex Deymo.

    [1] https://source.android.com/devices/architecture/dto/partitions

    Signed-off-by: Sam Protsenko
    Reviewed-by: Tom Rini

    Sam Protsenko