When fdt_fixup_memory_banks is called with 2-cell address and size
fields in the device-tree (IE: 64-bit address and size), then it will
overflow its on-stack "tmp" buffer.
This fixes the buffer size and adds a comment explaining how many bytes
need to be allocated per record.
Signed-off-by: Kyle Moffett <kyle.d.moff...@boeing.com>
---
common/fdt_support.c | 2 +-
1 files changed, 1 insertions(+), 1 deletions(-)
diff --git a/common/fdt_support.c b/common/fdt_support.c
index 6c98e5b..edcf04a 100644
--- a/common/fdt_support.c
+++ b/common/fdt_support.c
@@ -394,7 +394,7 @@ int fdt_fixup_memory_banks(void *blob, u64 start[], u64
size[], int banks)
{
int err, nodeoffset;
int addr_cell_len, size_cell_len, len;
- u8 tmp[banks * 8];
+ u8 tmp[banks * 16]; /* Up to 64-bit address + 64-bit size */
int bank;
err = fdt_check_header(blob);
--
1.7.2.3
_______________________________________________
U-Boot mailing list
U-Boot@lists.denx.de
http://lists.denx.de/mailman/listinfo/u-boot
