diff mbox series

lib: libfdt: fdt_region: avoid NULL pointer access

Message ID 1593711089-9494-1-git-send-email-philippe.reynes@softathome.com
State Accepted
Delegated to: Simon Glass
Headers show
Series lib: libfdt: fdt_region: avoid NULL pointer access | expand

Commit Message

Philippe REYNES July 2, 2020, 5:31 p.m. UTC
The function fdt_find_regions look in the exclude list for each
property, even if the name is NULL. It could happen if the fit
image is corrupted. On sandbox, it generates a segfault.

To avoid this issue, if the name of a property is NULL, we report
an error and avoid looking in the exclude list.

Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
---
 common/fdt_region.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Simon Glass July 3, 2020, 3:50 a.m. UTC | #1
On Thu, 2 Jul 2020 at 11:31, Philippe Reynes
<philippe.reynes@softathome.com> wrote:
>
> The function fdt_find_regions look in the exclude list for each
> property, even if the name is NULL. It could happen if the fit
> image is corrupted. On sandbox, it generates a segfault.
>
> To avoid this issue, if the name of a property is NULL, we report
> an error and avoid looking in the exclude list.
>
> Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
> ---
>  common/fdt_region.c | 2 ++
>  1 file changed, 2 insertions(+)
>

Reviewed-by: Simon Glass <sjg@chromium.org>
diff mbox series

Patch

diff --git a/common/fdt_region.c b/common/fdt_region.c
index 6676590..ff12c51 100644
--- a/common/fdt_region.c
+++ b/common/fdt_region.c
@@ -65,6 +65,8 @@  int fdt_find_regions(const void *fdt, char * const inc[], int inc_count,
 			stop_at = offset;
 			prop = fdt_get_property_by_offset(fdt, offset, NULL);
 			str = fdt_string(fdt, fdt32_to_cpu(prop->nameoff));
+			if (!str)
+				return -FDT_ERR_BADSTRUCTURE;
 			if (str_in_list(str, exc_prop, exc_prop_count))
 				include = 0;
 			break;