From f3d2ff3f5c3f49216b45a30b4b9a315a1b8d2142 Mon Sep 17 00:00:00 2001 From: Anton Ivanov Date: Tue, 2 Jun 2026 19:27:52 +0100 Subject: fdt: Check return value of fdt_get_name() calls fdt_get_name() can return NULL and set len to a negative error code. fdt_find_regions() does not check for this, leading to a potential NULL pointer dereference and a buffer out-of-bounds write during signature verification of an untrusted FIT. fdt_next_region(), fdt_check_full(), and display_fdt_by_regions() also lack validation. Add NULL checks and propagate the error code from fdt_get_name() to the caller. Signed-off-by: Anton Ivanov Reviewed-by: Simon Glass --- tools/fdtgrep.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'tools') diff --git a/tools/fdtgrep.c b/tools/fdtgrep.c index b4c041070f5..dba7240001f 100644 --- a/tools/fdtgrep.c +++ b/tools/fdtgrep.c @@ -355,6 +355,9 @@ static int display_fdt_by_regions(struct display_info *disp, const void *blob, case FDT_BEGIN_NODE: name = fdt_get_name(blob, offset, &len); + if (!name) + return len; + fprintf(f, "%*s%s {", depth++ * shift, "", *name ? name : "/"); break; -- cgit v1.3.1