• Geert Uytterhoeven's avatar
    of: overlay: Fix out-of-bounds write in init_overlay_changeset() · 35e691ed
    Geert Uytterhoeven authored
    If an overlay has no "__symbols__" node, but it has nodes without
    "__overlay__" subnodes at the end (e.g. a "__fixups__" node), after
    filling in all fragments for nodes with "__overlay__" subnodes,
    "fragment = &fragments[cnt]" will point beyond the end of the allocated
    array.
    
    Hence writing to "fragment->overlay" will overwrite unallocated memory,
    which may lead to a crash later.
    
    Fix this by deferring both the assignment to "fragment" and the
    offending write afterwards until we know for sure the node has an
    "__overlay__" subnode, and thus a valid entry in "fragments[]".
    
    Fixes: 61b4de4e ("of: overlay: minor restructuring")
    Signed-off-by: default avatarGeert Uytterhoeven <geert+renesas@glider.be>
    Signed-off-by: default avatarRob Herring <robh@kernel.org>
    35e691ed
overlay.c 25.4 KB