Mirrors/u-boot
1
0
Fork 0
mirror of https://source.denx.de/u-boot/u-boot.git synced 2026-06-02 09:46:37 +03:00
Code Issues Packages Projects Releases Wiki Activity

boot: fit: validate FDT/DTO payload before fdt_open_into()

Browse Source 
boot_get_fdt_fit_into_buffer() calls fdt_open_into() for both the
base FDT and overlay DTO blobs loaded from a FIT image.

Those blobs come from FIT payload data. In the overlay path,
fit_image_load() is called with FIT_LOAD_IGNORED, so the IH_TYPE_FLATDT
header check in fit_image_load() is skipped. This leaves fdt_open_into()
to consume header-derived offsets/sizes from unvalidated input.

Validate the full blob against the payload length first with
fdt_check_full(fdtsrcbuf, srclen), then proceed with fdt_totalsize() and
fdt_open_into(). This fixes Coverity CID 644638 (TAINTED_SCALAR).

Fixes: 5ebf0c55a2 ("image: fit: Apply overlays using aligned writable FDT copies")
Link: https://lore.kernel.org/all/20260223195109.GG3233182@bill-the-cat/
Signed-off-by: James Hilliard <james.hilliard1@gmail.com>
Reviewed-by: Tom Rini <trini@konsulko.com>
This commit is contained in:
James Hilliard
2026-02-23 13:40:04 -07:00
committed by Tom Rini
parent 26048cdb4c
commit 0b2939464f
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
boot/image-fit.c
View File

@@ -2390,6 +2390,14 @@ static int boot_get_fdt_fit_into_buffer(const void *src, ulong srclen,
fdtsrcbuf = tmp;
}
/*
* Source data comes from FIT payload. Validate the blob against
* payload length before fdt_open_into() trusts header offsets/sizes.
*/
err = fdt_check_full(fdtsrcbuf, srclen);
if (err < 0)
goto out;
newdstlen = ALIGN(fdt_totalsize(fdtsrcbuf) + extra, SZ_4K);
min_dstlen = ALIGN(min_dstlen, SZ_4K);
if (newdstlen < min_dstlen)