commit 9825f823eb5c9fc6b01e40f1b84108f5574235f2
author David Gibson <dgibson@sneetch.(none)> Thu Dec 14 15:29:25 2006 +1100
committer David Gibson <dgibson@sneetch.(none)> Thu Dec 14 15:29:25 2006 +1100
tree c01ac4522a04d36df2d92145667228454c705f9c
parent 6ae4de5c81eac62a0c658ef302c850da3f107092

libfdt: Fix bounds-checking bug in fdt_get_property()

The libfdt functions are supposed to behave tolerably well when practical,
even if given a corrupted device tree as input.  A silly mistake in
fdt_get_property() means we're bounds checking against the size of a pointer
instead of the size of a property header, meaning we can get bogus
behaviour in a corrupted device tree where the structure block ends in
what's supposed to be the middle of a property.

This patch corrects the problem (fdt_get_property() will now return
BADSTRUCTURE in this case), and also adds a testcase to catch the bug.