浏览代码

libfdt: Fix bug in fdt_subnode_offset_namelen()

There's currently an off-by-one bug in fdt_subnode_offset_namelen()
which causes it to keep searching after it's finished the subnodes of
the given parent, and into the subnodes of siblings of the original
node which come after it in the tree.

Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
Signed-off-by: Kumar Gala <galak@kernel.crashing.org>
David Gibson 16 年之前
父节点
当前提交
4bc7deee90
共有 1 个文件被更改,包括 7 次插入4 次删除
  1. 7 4
      libfdt/fdt_ro.c

+ 7 - 4
libfdt/fdt_ro.c

@@ -112,12 +112,12 @@ int fdt_num_mem_rsv(const void *fdt)
 int fdt_subnode_offset_namelen(const void *fdt, int offset,
 int fdt_subnode_offset_namelen(const void *fdt, int offset,
 			       const char *name, int namelen)
 			       const char *name, int namelen)
 {
 {
-	int depth;
+	int depth = 0;
 
 
 	FDT_CHECK_HEADER(fdt);
 	FDT_CHECK_HEADER(fdt);
 
 
-	for (depth = 0;
-	     offset >= 0;
+	for (depth = 0, offset = fdt_next_node(fdt, offset, &depth);
+	     (offset >= 0) && (depth > 0);
 	     offset = fdt_next_node(fdt, offset, &depth)) {
 	     offset = fdt_next_node(fdt, offset, &depth)) {
 		if (depth < 0)
 		if (depth < 0)
 			return -FDT_ERR_NOTFOUND;
 			return -FDT_ERR_NOTFOUND;
@@ -126,7 +126,10 @@ int fdt_subnode_offset_namelen(const void *fdt, int offset,
 			return offset;
 			return offset;
 	}
 	}
 
 
-	return offset; /* error */
+	if (offset < 0)
+		return offset; /* error */
+	else
+		return -FDT_ERR_NOTFOUND;
 }
 }
 
 
 int fdt_subnode_offset(const void *fdt, int parentoffset,
 int fdt_subnode_offset(const void *fdt, int parentoffset,