scripts/dtc: Update to upstream commit b06e55c88b9b

Sync to upstream dtc commit b06e55c88b9b ("Prevent crash on modulo by
zero"). This adds the following commits from upstream:

b06e55c Prevent crash on modulo by zero
b433450 Fix some bugs in processing of line directives
d728ad5 Fix crash on nul character in string escape sequence
1ab2205 Gracefully handle bad octal literals
1937095 Prevent crash on division by zero
d0b3ab0 libfdt: Fix undefined behaviour in fdt_offset_ptr()
d4c7c25 libfdt: check for potential overrun in _fdt_splice()
f58799b libfdt: Add some missing symbols to version.lds
af9f26d Remove duplicated -Werror in dtc Makefile
604e61e fdt: Add functions to retrieve strings
8702bd1 fdt: Add a function to get the index of a string
2218387 fdt: Add a function to count strings
554fde2 libfdt: fix comment block of fdt_get_property_namelen()
e5e6df7 fdtdump: Fix bug printing bytestrings with negative values
067829e Remove redundant fdtdump test code
897a429 Move fdt_path_offset alias tests to right tests section
2d1417c Add simple .travis.yml
f6dbc6c guess output file format
5e78dff guess input file format based on file content or file name
8b927bf tests: convert `echo -n` to `printf`
64c46b0 Fix crash with poorly defined #size-cells

Cc: Grant Likely <grant.likely@linaro.org>
Tested-by: Frank Rowand <frank.rowand@sonymobile.com>
Reviewed-by: Frank Rowand <frank.rowand@sonymobile.com>
Signed-off-by: Rob Herring <robh@kernel.org>

4 files changed, 179 insertions, 9 deletions

diff --git a/scripts/dtc/libfdt/fdt.c b/scripts/dtc/libfdt/fdt.c
index 2ce6a44179de..22286a1aaeaf 100644
--- a/scripts/dtc/libfdt/fdt.c
+++ b/scripts/dtc/libfdt/fdt.c
@@ -76,18 +76,19 @@ int fdt_check_header(const void *fdt)
 
 const void *fdt_offset_ptr(const void *fdt, int offset, unsigned int len)
 {
-        const char *p;
+        unsigned absoffset = offset + fdt_off_dt_struct(fdt);
+
+        if ((absoffset < offset)
+            || ((absoffset + len) < absoffset)
+            || (absoffset + len) > fdt_totalsize(fdt))
+                return NULL;
 
         if (fdt_version(fdt) >= 0x11)
                 if (((offset + len) < offset)
                     || ((offset + len) > fdt_size_dt_struct(fdt)))
                         return NULL;
 
-        p = _fdt_offset_ptr(fdt, offset);
-
-        if (p + len < p)
-                return NULL;
-        return p;
+        return _fdt_offset_ptr(fdt, offset);
 }
 
 uint32_t fdt_next_tag(const void *fdt, int startoffset, int *nextoffset)
diff --git a/scripts/dtc/libfdt/fdt_ro.c b/scripts/dtc/libfdt/fdt_ro.c
index a65e4b5b72b6..e5b313682007 100644
--- a/scripts/dtc/libfdt/fdt_ro.c
+++ b/scripts/dtc/libfdt/fdt_ro.c
@@ -538,6 +538,106 @@ int fdt_stringlist_contains(const char *strlist, int listlen, const char *str)
         return 0;
 }
 
+int fdt_stringlist_count(const void *fdt, int nodeoffset, const char *property)
+{
+        const char *list, *end;
+        int length, count = 0;
+
+        list = fdt_getprop(fdt, nodeoffset, property, &length);
+        if (!list)
+                return -length;
+
+        end = list + length;
+
+        while (list < end) {
+                length = strnlen(list, end - list) + 1;
+
+                /* Abort if the last string isn't properly NUL-terminated. */
+                if (list + length > end)
+                        return -FDT_ERR_BADVALUE;
+
+                list += length;
+                count++;
+        }
+
+        return count;
+}
+
+int fdt_stringlist_search(const void *fdt, int nodeoffset, const char *property,
+                          const char *string)
+{
+        int length, len, idx = 0;
+        const char *list, *end;
+
+        list = fdt_getprop(fdt, nodeoffset, property, &length);
+        if (!list)
+                return -length;
+
+        len = strlen(string) + 1;
+        end = list + length;
+
+        while (list < end) {
+                length = strnlen(list, end - list) + 1;
+
+                /* Abort if the last string isn't properly NUL-terminated. */
+                if (list + length > end)
+                        return -FDT_ERR_BADVALUE;
+
+                if (length == len && memcmp(list, string, length) == 0)
+                        return idx;
+
+                list += length;
+                idx++;
+        }
+
+        return -FDT_ERR_NOTFOUND;
+}
+
+const char *fdt_stringlist_get(const void *fdt, int nodeoffset,
+                               const char *property, int idx,
+                               int *lenp)
+{
+        const char *list, *end;
+        int length;
+
+        list = fdt_getprop(fdt, nodeoffset, property, &length);
+        if (!list) {
+                if (lenp)
+                        *lenp = length;
+
+                return NULL;
+        }
+
+        end = list + length;
+
+        while (list < end) {
+                length = strnlen(list, end - list) + 1;
+
+                /* Abort if the last string isn't properly NUL-terminated. */
+                if (list + length > end) {
+                        if (lenp)
+                                *lenp = -FDT_ERR_BADVALUE;
+
+                        return NULL;
+                }
+
+                if (idx == 0) {
+                        if (lenp)
+                                *lenp = length - 1;
+
+                        return list;
+                }
+
+                list += length;
+                idx--;
+        }
+
+        if (lenp)
+                *lenp = -FDT_ERR_NOTFOUND;
+
+        return NULL;
+}
+
 int fdt_node_check_compatible(const void *fdt, int nodeoffset,
                               const char *compatible)
 {
diff --git a/scripts/dtc/libfdt/fdt_rw.c b/scripts/dtc/libfdt/fdt_rw.c
index 70adec6c371b..8be02b1f68f3 100644
--- a/scripts/dtc/libfdt/fdt_rw.c
+++ b/scripts/dtc/libfdt/fdt_rw.c
@@ -101,6 +101,8 @@ static int _fdt_splice(void *fdt, void *splicepoint, int oldlen, int newlen)
 
         if (((p + oldlen) < p) || ((p + oldlen) > end))
                 return -FDT_ERR_BADOFFSET;
+        if ((p < (char *)fdt) || ((end - oldlen + newlen) < (char *)fdt))
+                return -FDT_ERR_BADOFFSET;
         if ((end - oldlen + newlen) > ((char *)fdt + fdt_totalsize(fdt)))
                 return -FDT_ERR_NOSPACE;
         memmove(p + newlen, p + oldlen, end - p - oldlen);
diff --git a/scripts/dtc/libfdt/libfdt.h b/scripts/dtc/libfdt/libfdt.h
index ea35ac3c9be4..59ca33976e56 100644
--- a/scripts/dtc/libfdt/libfdt.h
+++ b/scripts/dtc/libfdt/libfdt.h
@@ -121,7 +121,12 @@
         /* FDT_ERR_BADNCELLS: Device tree has a #address-cells, #size-cells
          * or similar property with a bad format or value */
 
-#define FDT_ERR_MAX             14
+#define FDT_ERR_BADVALUE        15
+        /* FDT_ERR_BADVALUE: Device tree has a property with an unexpected
+         * value. For example: a property expected to contain a string list
+         * is not NUL-terminated within the length of its value. */
+
+#define FDT_ERR_MAX             15
 
 /**********************************************************************/
 /* Low-level functions (you probably don't need these)                */
@@ -457,8 +462,8 @@ const struct fdt_property *fdt_get_property_by_offset(const void *fdt,
  * @namelen: number of characters of name to consider
  * @lenp: pointer to an integer variable (will be overwritten) or NULL
  *
- * Identical to fdt_get_property_namelen(), but only examine the first
- * namelen characters of name for matching the property name.
+ * Identical to fdt_get_property(), but only examine the first namelen
+ * characters of name for matching the property name.
  */
 const struct fdt_property *fdt_get_property_namelen(const void *fdt,
                                                     int nodeoffset,
@@ -868,6 +873,68 @@ int fdt_node_offset_by_compatible(const void *fdt, int startoffset,
  */
 int fdt_stringlist_contains(const char *strlist, int listlen, const char *str);
 
+/**
+ * fdt_stringlist_count - count the number of strings in a string list
+ * @fdt: pointer to the device tree blob
+ * @nodeoffset: offset of a tree node
+ * @property: name of the property containing the string list
+ * @return:
+ *   the number of strings in the given property
+ *   -FDT_ERR_BADVALUE if the property value is not NUL-terminated
+ *   -FDT_ERR_NOTFOUND if the property does not exist
+ */
+int fdt_stringlist_count(const void *fdt, int nodeoffset, const char *property);
+
+/**
+ * fdt_stringlist_search - find a string in a string list and return its index
+ * @fdt: pointer to the device tree blob
+ * @nodeoffset: offset of a tree node
+ * @property: name of the property containing the string list
+ * @string: string to look up in the string list
+ *
+ * Note that it is possible for this function to succeed on property values
+ * that are not NUL-terminated. That's because the function will stop after
+ * finding the first occurrence of @string. This can for example happen with
+ * small-valued cell properties, such as #address-cells, when searching for
+ * the empty string.
+ *
+ * @return:
+ *   the index of the string in the list of strings
+ *   -FDT_ERR_BADVALUE if the property value is not NUL-terminated
+ *   -FDT_ERR_NOTFOUND if the property does not exist or does not contain
+ *                     the given string
+ */
+int fdt_stringlist_search(const void *fdt, int nodeoffset, const char *property,
+                          const char *string);
+
+/**
+ * fdt_stringlist_get() - obtain the string at a given index in a string list
+ * @fdt: pointer to the device tree blob
+ * @nodeoffset: offset of a tree node
+ * @property: name of the property containing the string list
+ * @index: index of the string to return
+ * @lenp: return location for the string length or an error code on failure
+ *
+ * Note that this will successfully extract strings from properties with
+ * non-NUL-terminated values. For example on small-valued cell properties
+ * this function will return the empty string.
+ *
+ * If non-NULL, the length of the string (on success) or a negative error-code
+ * (on failure) will be stored in the integer pointer to by lenp.
+ *
+ * @return:
+ *   A pointer to the string at the given index in the string list or NULL on
+ *   failure. On success the length of the string will be stored in the memory
+ *   location pointed to by the lenp parameter, if non-NULL. On failure one of
+ *   the following negative error codes will be returned in the lenp parameter
+ *   (if non-NULL):
+ *     -FDT_ERR_BADVALUE if the property value is not NUL-terminated
+ *     -FDT_ERR_NOTFOUND if the property does not exist
+ */
+const char *fdt_stringlist_get(const void *fdt, int nodeoffset,
+                               const char *property, int index,
+                               int *lenp);
+
 /**********************************************************************/
 /* Read-only functions (addressing related)                           */
 /**********************************************************************/