test: dm: fdtdec: Validate FDT size in unit test

The current FDT decoding tests calculate the memory required
for FDT manipulation by directly adding a fixed margin to
fdt_totalsize(gd->fdt_blob). The static analyzer flagged
"gd->fdt_blob->totalsize" as a tainted value being passed
to fdt_open_into().

Ensure the size is validated by checking that the total size
is within a reasonable maximum FDT limit for unit tests.

Signed-off-by: Adriana Nicolae <adriana@arista.com>

diff --git a/test/dm/fdtdec.c b/test/dm/fdtdec.c
index ea5a494612c690342c16a36da5cee3c7f918105d..495f57234a45fb55693fa752f5f6509a0e121758 100644 (file)
--- a/test/dm/fdtdec.c
+++ b/test/dm/fdtdec.c
@@ -14,14 +14,19 @@
 
 DECLARE_GLOBAL_DATA_PTR;
 
+#define FDTDEC_MAX_SIZE  (2 * 1024 * 1024)
+
 static int dm_test_fdtdec_set_carveout(struct unit_test_state *uts)
 {
        struct fdt_memory resv;
        void *blob;
        const fdt32_t *prop;
-       int blob_sz, len, offset;
+       int blob_sz, len, offset, fdt_sz;
+
+       fdt_sz = fdt_totalsize(gd->fdt_blob);
+       ut_assert(fdt_sz > 0 && fdt_sz < FDTDEC_MAX_SIZE);
 
-       blob_sz = fdt_totalsize(gd->fdt_blob) + 4096;
+       blob_sz = fdt_sz + 4096;
        blob = malloc(blob_sz);
        ut_assertnonnull(blob);
 
@@ -67,10 +72,13 @@ static int dm_test_fdtdec_add_reserved_memory(struct unit_test_state *uts)
        fdt_size_t size;
        void *blob;
        unsigned long flags = FDTDEC_RESERVED_MEMORY_NO_MAP;
-       int blob_sz, parent, subnode;
+       int blob_sz, parent, subnode, fdt_sz;
        uint32_t phandle, phandle1;
 
-       blob_sz = fdt_totalsize(gd->fdt_blob) + 128;
+       fdt_sz = fdt_totalsize(gd->fdt_blob);
+       ut_assert(fdt_sz > 0 && fdt_sz < FDTDEC_MAX_SIZE);
+
+       blob_sz = fdt_sz + 128;
        blob = malloc(blob_sz);
        ut_assertnonnull(blob);
 
@@ -138,14 +146,17 @@ static int dm_test_fdt_chosen_smbios(struct unit_test_state *uts)
        void *blob;
        ulong val;
        struct smbios3_entry *entry;
-       int chosen, blob_sz;
+       int chosen, blob_sz, fdt_sz;
        const fdt64_t *prop;
 
        if (!CONFIG_IS_ENABLED(GENERATE_SMBIOS_TABLE)) {
                return -EAGAIN;
        }
 
-       blob_sz = fdt_totalsize(gd->fdt_blob) + 4096;
+       fdt_sz = fdt_totalsize(gd->fdt_blob);
+       ut_assert(fdt_sz > 0 && fdt_sz < FDTDEC_MAX_SIZE);
+
+       blob_sz = fdt_sz + 4096;
        blob = memalign(8, blob_sz);
        ut_assertnonnull(blob);