@@ -676,7 +676,8 @@ static int dtoverlay_phandle_relocate(DTBLOB_T *dtb, int node_off,
676676
677677// Returns 0 on success, or an FDT error code
678678static int dtoverlay_apply_fixups (DTBLOB_T * dtb , const char * fixups_stringlist ,
679- uint32_t phandle , fixup_type_t type )
679+ int fixups_len , uint32_t phandle ,
680+ fixup_type_t type )
680681{
681682 // The fixups arrive as a sequence of NUL-terminated strings, of the form:
682683 // "path:property:offset"
@@ -687,8 +688,9 @@ static int dtoverlay_apply_fixups(DTBLOB_T *dtb, const char *fixups_stringlist,
687688 // 4) the code is simpler as a result.
688689
689690 const char * fixup = fixups_stringlist ;
691+ const char * end = fixup + fixups_len ;
690692
691- while (fixup [0 ])
693+ while (fixup < end && fixup [0 ])
692694 {
693695 const char * prop_name , * offset_str ;
694696 char * offset_end ;
@@ -853,7 +855,7 @@ static int dtoverlay_resolve_phandles(DTBLOB_T *base_dtb, DTBLOB_T *overlay_dtb)
853855 if (fixups_stringlist )
854856 {
855857 // Relocate the overlay phandle references
856- err = dtoverlay_apply_fixups (overlay_dtb , fixups_stringlist ,
858+ err = dtoverlay_apply_fixups (overlay_dtb , fixups_stringlist , err ,
857859 base_dtb -> max_phandle , FIXUP_RELATIVE );
858860 }
859861 else
@@ -906,7 +908,7 @@ static int dtoverlay_resolve_fixups(DTBLOB_T *base_dtb, DTBLOB_T *overlay_dtb)
906908 {
907909 const char * fixups_stringlist , * symbol_name , * target_path ;
908910 const char * ref_type ;
909- int target_off ;
911+ int target_off , fixups_len ;
910912 uint32_t target_phandle ;
911913
912914 // The property name identifies a symbol (or alias) in the base.
@@ -920,6 +922,8 @@ static int dtoverlay_resolve_fixups(DTBLOB_T *base_dtb, DTBLOB_T *overlay_dtb)
920922 break ;
921923 }
922924
925+ fixups_len = err ;
926+
923927 // 1) Find the target node.
924928 if (symbol_name [0 ] == '/' )
925929 {
@@ -973,10 +977,13 @@ static int dtoverlay_resolve_fixups(DTBLOB_T *base_dtb, DTBLOB_T *overlay_dtb)
973977
974978 // Now apply the valid target_phandle to the items in the fixup string
975979
976- err = dtoverlay_apply_fixups (overlay_dtb , fixups_stringlist ,
980+ err = dtoverlay_apply_fixups (overlay_dtb , fixups_stringlist , fixups_len ,
977981 target_phandle , FIXUP_ABSOLUTE );
978982 if (err )
983+ {
984+ dtoverlay_error ("failed to apply fixups" );
979985 break ;
986+ }
980987 }
981988 }
982989
@@ -2343,9 +2350,11 @@ static const char *dtoverlay_extract_immediate(const char *data, const char *dat
23432350 return NULL ;
23442351 }
23452352 val = dtoverlay_read_u32 (data , 0 );
2346- cell_source = data ;
23472353 if (buf )
2354+ {
2355+ cell_source = data ;
23482356 snprintf (buf , buf_len , "%d" , val );
2357+ }
23492358 data += 4 ;
23502359 }
23512360 else if (data [0 ] == '\'' )
0 commit comments