diff options
| author | Tom Rini <trini@konsulko.com> | 2021-02-15 19:19:56 -0500 |
|---|---|---|
| committer | Tom Rini <trini@konsulko.com> | 2021-02-15 22:31:54 -0500 |
| commit | b6f4c757959f8850e1299a77c8e5713da78e8ec0 (patch) | |
| tree | 2de8580b23f833e100a186448625721d71625521 /scripts/dtc/libfdt/fdt_ro.c | |
| parent | 6144438fb5c9059dc87cf219bed0c992f70b3509 (diff) | |
| parent | 3f04db891a353f4b127ed57279279f851c6b4917 (diff) | |
Merge branch '2021-02-15-fix-CVE-2021-27097-CVE-2021-27138'
Fix CVE-2021-27097 and CVE-2021-27138. For more details see
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27097 and
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27138
Diffstat (limited to 'scripts/dtc/libfdt/fdt_ro.c')
| -rw-r--r-- | scripts/dtc/libfdt/fdt_ro.c | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/scripts/dtc/libfdt/fdt_ro.c b/scripts/dtc/libfdt/fdt_ro.c index d984bab036b..efe7efe9211 100644 --- a/scripts/dtc/libfdt/fdt_ro.c +++ b/scripts/dtc/libfdt/fdt_ro.c @@ -867,6 +867,7 @@ int fdt_check_full(const void *fdt, size_t bufsize) unsigned depth = 0; const void *prop; const char *propname; + bool expect_end = false; if (bufsize < FDT_V1_SIZE) return -FDT_ERR_TRUNCATED; @@ -887,6 +888,10 @@ int fdt_check_full(const void *fdt, size_t bufsize) if (nextoffset < 0) return nextoffset; + /* If we see two root nodes, something is wrong */ + if (expect_end && tag != FDT_END) + return -FDT_ERR_BADLAYOUT; + switch (tag) { case FDT_NOP: break; @@ -900,12 +905,24 @@ int fdt_check_full(const void *fdt, size_t bufsize) depth++; if (depth > INT_MAX) return -FDT_ERR_BADSTRUCTURE; + + /* The root node must have an empty name */ + if (depth == 1) { + const char *name; + int len; + + name = fdt_get_name(fdt, offset, &len); + if (*name || len) + return -FDT_ERR_BADLAYOUT; + } break; case FDT_END_NODE: if (depth == 0) return -FDT_ERR_BADSTRUCTURE; depth--; + if (depth == 0) + expect_end = true; break; case FDT_PROP: |