77c77
< const void *fdt_offset_ptr(const void *fdt, int offset, int len)
---
> const void *fdt_offset_ptr(const void *fdt, int offset, unsigned int len)
93c93
< uint32_t fdt_next_tag(const void *fdt, int offset, int *nextoffset)
---
> uint32_t fdt_next_tag(const void *fdt, int startoffset, int *nextoffset)
96a97
> int offset = startoffset;
99,101c100
< if (offset % FDT_TAGSIZE)
< return -1;
<
---
> *nextoffset = -FDT_ERR_TRUNCATED;
103c102
< if (! tagp)
---
> if (!tagp)
107a107
> *nextoffset = -FDT_ERR_BADSTRUCTURE;
114,115c114,115
< if (! p)
< return FDT_END;
---
> if (!p)
> return FDT_END; /* premature end */
116a117
>
119,122c120,124
< if (! lenp)
< return FDT_END;
< /* skip name offset, length and value */
< offset += 2*FDT_TAGSIZE + fdt32_to_cpu(*lenp);
---
> if (!lenp)
> return FDT_END; /* premature end */
> /* skip-name offset, length and value */
> offset += sizeof(struct fdt_property) - FDT_TAGSIZE
> + fdt32_to_cpu(*lenp);
123a126,133
>
> case FDT_END:
> case FDT_END_NODE:
> case FDT_NOP:
> break;
>
> default:
> return FDT_END;
126,127c136,137
< if (nextoffset)
< *nextoffset = FDT_TAGALIGN(offset);
---
> if (!fdt_offset_ptr(fdt, startoffset, offset - startoffset))
> return FDT_END; /* premature end */
128a139
> *nextoffset = FDT_TAGALIGN(offset);
165,166c176,177
< if (depth)
< (*depth)--;
---
> if (depth && ((--(*depth)) < 0))
> return nextoffset;
170,173c181,185
< return -FDT_ERR_NOTFOUND;
<
< default:
< return -FDT_ERR_BADSTRUCTURE;
---
> if ((nextoffset >= 0)
> || ((nextoffset == -FDT_ERR_TRUNCATED) && !depth))
> return -FDT_ERR_NOTFOUND;
> else
> return nextoffset;