From: anonymix007 <48598263+anonymix007@users.noreply.github.com> Date: Wed, 6 Nov 2024 20:03:12 +0000 (+0300) Subject: boot: Fix overflow check for FDT_PROP in devicetree_get_compatible X-Git-Tag: v257-rc2~44^2~6 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=145479f4d0a1c568a39682a9bf12f8b1151bed20;p=thirdparty%2Fsystemd.git boot: Fix overflow check for FDT_PROP in devicetree_get_compatible --- diff --git a/src/boot/devicetree.c b/src/boot/devicetree.c index 842b96a97d9..2ec5ca28dd8 100644 --- a/src/boot/devicetree.c +++ b/src/boot/devicetree.c @@ -131,6 +131,7 @@ static const char* devicetree_get_compatible(const void *dtb) { if (struct_off % sizeof(uint32_t) != 0) return NULL; + if (struct_size % sizeof(uint32_t) != 0 || !ADD_SAFE(&end, struct_off, struct_size) || end > strings_off) @@ -150,7 +151,7 @@ static const char* devicetree_get_compatible(const void *dtb) { break; case FDT_PROP: /* At least 3 words should present: len, name_off, c (nul-terminated string always has non-zero length) */ - if (i + 3 >= size_words || cursor[++i] != 0) + if (i + 3 >= size_words) return NULL; len = be32toh(cursor[++i]); name_off = be32toh(cursor[++i]);