RTEMS | cpukit/libmisc: A string conversion overflow and an unaligned device tree (#5708)

[Sebastian Huber (@sebhub)]

Issue created by Sebastian Huber: https://gitlab.rtems.org/rtems/rtos/rtems/-/work_items/5708



The string to integer conversion returns a type which can be wider than the type
of the value. The result is stored in the type of the value before the range is
checked, so the check sees a truncated value. On a 64 bit target
`rtems_string_to_int()` returns success for a value outside the range of an int.

A flattened device tree blob must start at an address which is a multiple of
eight, otherwise libfdt rejects it with `FDT_ERR_ALIGNMENT`. The blob is
allocated by `rtems_malloc()`, which provides the heap alignment of the target.
That is four bytes on MicroBlaze, so no blob can be loaded there at all.

Found while running the full test suite on eleven simulators. This description
was created with Claude Code assistance.

-- 
View it on GitLab: https://gitlab.rtems.org/rtems/rtos/rtems/-/work_items/5708
You're receiving this email because of your account on gitlab.rtems.org. Unsubscribe from this thread: https://gitlab.rtems.org/-/sent_notifications/5-ab6d6koee8x3u7lvv1mtv9uk8-1d/unsubscribe | Manage all notifications: https://gitlab.rtems.org/-/profile/notifications | Help: https://gitlab.rtems.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rtems.org/pipermail/bugs/attachments/20260817/11e07788/attachment.htm>