diff options
| author | Heinrich Schuchardt <heinrich.schuchardt@canonical.com> | 2025-06-24 17:34:30 +0200 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2025-06-26 11:58:17 -0600 |
| commit | 6ef9a89c1da433108ac89deab58954c6e2b798ba (patch) | |
| tree | 3dbc4b33faf9da45e90a0138785caff7bc82a8f6 | |
| parent | 8bb9c275c484206c0314014d8215770aaac4cefe (diff) | |
common/spl: Revert fix potential out of buffer access in spl_fit_get_image_name function
The change in commit 3704b888a4ca ("common/spl: fix potential out of buffer
access in spl_fit_get_image_name function") led to function
spl_fit_get_image_name() no longer detecting if a property does not exist
at a non-zero buffer.
Link: https://lore.kernel.org/u-boot/38f5d078-3328-4bdb-9c95-4fb5fe89ddc2@gmx.de/T/#m59f3a23e675daa992c28d12236de71cae2ca2bb9
Fixes: 3704b888a4ca ("common/spl: fix potential out of buffer access in spl_fit_get_image_name function")
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Tested-by: E Shattow <e@freeshell.de>
| -rw-r--r-- | common/spl/spl_fit.c | 5 |
1 files changed, 2 insertions, 3 deletions
diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c index b3824af475f..e250c11ebbd 100644 --- a/common/spl/spl_fit.c +++ b/common/spl/spl_fit.c @@ -86,12 +86,11 @@ static int spl_fit_get_image_name(const struct spl_fit_info *ctx, str = name; for (i = 0; i < index; i++) { - str = memchr(str, '\0', name + len - str); - if (!str) { + str = strchr(str, '\0') + 1; + if (!str || (str - name >= len)) { found = false; break; } - str++; } if (!found && CONFIG_IS_ENABLED(SYSINFO) && !sysinfo_get(&sysinfo)) { |