diff options
| author | Heinrich Schuchardt <heinrich.schuchardt@canonical.com> | 2025-06-24 17:34:31 +0200 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2025-06-26 11:58:17 -0600 |
| commit | 79f8f31d58dfcd2b3563c32f1cf1097cee4d7f76 (patch) | |
| tree | 0cc2926ca92003fb6f9e948b62a1b7affa07344d /common/spl/spl_fit.c | |
| parent | 6ef9a89c1da433108ac89deab58954c6e2b798ba (diff) | |
common/spl: guard against buffer overflow in spl_fit_get_image_name()
A malformed FIT image could have an image name property that is not NUL
terminated. Reject such images.
Reported-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Tested-by: E Shattow <e@freeshell.de>
Diffstat (limited to 'common/spl/spl_fit.c')
| -rw-r--r-- | common/spl/spl_fit.c | 10 |
1 files changed, 8 insertions, 2 deletions
diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c index e250c11ebbd..25f3c822a49 100644 --- a/common/spl/spl_fit.c +++ b/common/spl/spl_fit.c @@ -73,7 +73,7 @@ static int spl_fit_get_image_name(const struct spl_fit_info *ctx, const char **outname) { struct udevice *sysinfo; - const char *name, *str; + const char *name, *str, *end; __maybe_unused int node; int len, i; bool found = true; @@ -83,11 +83,17 @@ static int spl_fit_get_image_name(const struct spl_fit_info *ctx, debug("cannot find property '%s': %d\n", type, len); return -EINVAL; } + /* A string property should be NUL terminated */ + end = name + len - 1; + if (!len || *end) { + debug("malformed property '%s'\n", type); + return -EINVAL; + } str = name; for (i = 0; i < index; i++) { str = strchr(str, '\0') + 1; - if (!str || (str - name >= len)) { + if (str > end) { found = false; break; } |