| Message ID | 1593711089-9494-1-git-send-email-philippe.reynes@softathome.com |
|---|---|
| State | Accepted |
| Commit | 2a3be302d5dd221ea64b85a700746b322e30f064 |
| Headers | show |
| Series | lib: libfdt: fdt_region: avoid NULL pointer access | expand |
On Thu, 2 Jul 2020 at 11:31, Philippe Reynes <philippe.reynes at softathome.com> wrote: > > The function fdt_find_regions look in the exclude list for each > property, even if the name is NULL. It could happen if the fit > image is corrupted. On sandbox, it generates a segfault. > > To avoid this issue, if the name of a property is NULL, we report > an error and avoid looking in the exclude list. > > Signed-off-by: Philippe Reynes <philippe.reynes at softathome.com> > --- > common/fdt_region.c | 2 ++ > 1 file changed, 2 insertions(+) > Reviewed-by: Simon Glass <sjg at chromium.org>
diff --git a/common/fdt_region.c b/common/fdt_region.c index 6676590..ff12c51 100644 --- a/common/fdt_region.c +++ b/common/fdt_region.c @@ -65,6 +65,8 @@ int fdt_find_regions(const void *fdt, char * const inc[], int inc_count, stop_at = offset; prop = fdt_get_property_by_offset(fdt, offset, NULL); str = fdt_string(fdt, fdt32_to_cpu(prop->nameoff)); + if (!str) + return -FDT_ERR_BADSTRUCTURE; if (str_in_list(str, exc_prop, exc_prop_count)) include = 0; break;
The function fdt_find_regions look in the exclude list for each property, even if the name is NULL. It could happen if the fit image is corrupted. On sandbox, it generates a segfault. To avoid this issue, if the name of a property is NULL, we report an error and avoid looking in the exclude list. Signed-off-by: Philippe Reynes <philippe.reynes at softathome.com> --- common/fdt_region.c | 2 ++ 1 file changed, 2 insertions(+)