Snap for 9454839 from b3a49bc3b7735690cead723f7dc3feea05e3de87 to tm-qpr2-releaseandroid-13.0.0_r49android-13.0.0_r45android-13.0.0_r44android-13.0.0_r43android-13.0.0_r42android-13.0.0_r41android-13.0.0_r40android-13.0.0_r39android-13.0.0_r38android-13.0.0_r37android-13.0.0_r36android-13.0.0_r35android-13.0.0_r34android-13.0.0_r33android-13.0.0_r32android13-qpr2-s9-releaseandroid13-qpr2-s8-releaseandroid13-qpr2-s7-releaseandroid13-qpr2-s6-releaseandroid13-qpr2-s5-releaseandroid13-qpr2-s3-releaseandroid13-qpr2-s2-releaseandroid13-qpr2-s12-releaseandroid13-qpr2-s11-releaseandroid13-qpr2-s10-releaseandroid13-qpr2-s1-releaseandroid13-qpr2-releaseandroid13-qpr2-b-s1-release

Change-Id: Ia7c3987d5786ff9d23df2f3b4578468aeb76bb89

2 files changed, 11 insertions, 4 deletions

diff --git a/ufdt_convert.c b/ufdt_convert.c
index 9e7922a..8ce58b7 100644
--- a/ufdt_convert.c
+++ b/ufdt_convert.c
@@ -344,10 +344,11 @@ static int _ufdt_output_property_to_fdt(
 
   int data_len = 0;
   void *data = ufdt_node_get_fdt_prop_data(&prop_node->parent, &data_len);
-  int aligned_data_len = (data_len + (FDT_TAGSIZE - 1)) & ~(FDT_TAGSIZE - 1);
+  unsigned int aligned_data_len =
+      ((unsigned int)data_len + (FDT_TAGSIZE - 1u)) & ~(FDT_TAGSIZE - 1u);
 
-  int new_propoff = fdt_size_dt_struct(fdtp);
-  int new_prop_size = sizeof(struct fdt_property) + aligned_data_len;
+  unsigned int new_propoff = fdt_size_dt_struct(fdtp);
+  unsigned int new_prop_size = sizeof(struct fdt_property) + aligned_data_len;
   struct fdt_property *new_prop =
       (struct fdt_property *)((char *)fdtp + fdt_off_dt_struct(fdtp) +
                               new_propoff);
diff --git a/ufdt_node.c b/ufdt_node.c
index 309c674..730b401 100644
--- a/ufdt_node.c
+++ b/ufdt_node.c
@@ -118,7 +118,13 @@ char *ufdt_node_get_fdt_prop_data(const struct ufdt_node *node, int *out_len) {
   }
   const struct fdt_property *prop = (struct fdt_property *)node->fdt_tag_ptr;
   if (out_len != NULL) {
-    *out_len = fdt32_to_cpu(prop->len);
+    uint32_t prop_len = fdt32_to_cpu(prop->len);
+
+    if (prop_len > INT_MAX) {
+      return NULL;
+    }
+
+    *out_len = prop_len;
   }
   return (char *)prop->data;
 }