diff options
| author | Anton Ivanov <[email protected]> | 2026-06-02 19:30:17 +0100 |
|---|---|---|
| committer | Tom Rini <[email protected]> | 2026-06-12 15:35:56 -0600 |
| commit | 7304d569e61521e04625bfbded894f2e5fbe4409 (patch) | |
| tree | e264c33b824c3152e55530527074bd557f57f1bd | |
| parent | e73328612534e81b41d0363fad9a7b4385cd3d39 (diff) | |
fdt_region: Check return value of fdt_get_property_by_offset() calls
fdt_get_property_by_offset() returns NULL for FDT with version
less than 0x10. fdt_find_regions() dereferences the result without
checking, leading to a NULL pointer dereference during signature
verification of an untrusted FIT. fdt_add_alias_regions() and
fdt_next_region() also lack validation.
Add NULL checks before accessing the returned property pointer.
Also add a missing NULL check for fdt_string() in
fdt_add_alias_regions() and fdt_next_region().
Signed-off-by: Anton Ivanov <[email protected]>
| -rw-r--r-- | boot/fdt_region.c | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/boot/fdt_region.c b/boot/fdt_region.c index 295ea08ac91..0a9d47bb2bd 100644 --- a/boot/fdt_region.c +++ b/boot/fdt_region.c @@ -69,6 +69,8 @@ int fdt_find_regions(const void *fdt, char * const inc[], int inc_count, include = want >= 2; stop_at = offset; prop = fdt_get_property_by_offset(fdt, offset, NULL); + if (!prop) + return -FDT_ERR_BADSTRUCTURE; str = fdt_string(fdt, fdt32_to_cpu(prop->nameoff)); if (!str) return -FDT_ERR_BADSTRUCTURE; @@ -271,7 +273,11 @@ int fdt_add_alias_regions(const void *fdt, struct fdt_region *region, int count, int target, next; prop = fdt_get_property_by_offset(fdt, offset, NULL); + if (!prop) + return -FDT_ERR_BADSTRUCTURE; name = fdt_string(fdt, fdt32_to_cpu(prop->nameoff)); + if (!name) + return -FDT_ERR_BADSTRUCTURE; target = fdt_path_offset(fdt, name); if (!region_list_contains_offset(info, fdt, target)) continue; @@ -520,7 +526,11 @@ int fdt_next_region(const void *fdt, case FDT_PROP: stop_at = offset; prop = fdt_get_property_by_offset(fdt, offset, NULL); + if (!prop) + return -FDT_ERR_BADSTRUCTURE; str = fdt_string(fdt, fdt32_to_cpu(prop->nameoff)); + if (!str) + return -FDT_ERR_BADSTRUCTURE; val = h_include(priv, fdt, last_node, FDT_IS_PROP, str, strlen(str) + 1); if (val == -1) { |