fdt: Check return value of fdt_get_name() calls

fdt_get_name() can return NULL and set len to a negative error code.
fdt_find_regions() does not check for this, leading to a potential NULL
pointer dereference and a buffer out-of-bounds write during signature
verification of an untrusted FIT. fdt_next_region(), fdt_check_full(),
and display_fdt_by_regions() also lack validation.

Add NULL checks and propagate the error code from fdt_get_name()
to the caller.

Signed-off-by: Anton Ivanov <anton@binarly.io>
Reviewed-by: Simon Glass <sjg@chromium.org>

diff --git a/boot/fdt_region.c b/boot/fdt_region.c
index 0a9d47bb2bd3157ebe798d1cce00c537d8251683..dd6e87925be0e0a55432fdacd3e085da892164b4 100644 (file)
--- a/boot/fdt_region.c
+++ b/boot/fdt_region.c
@@ -88,6 +88,8 @@ int fdt_find_regions(const void *fdt, char * const inc[], int inc_count,
                        if (depth == FDT_MAX_DEPTH)
                                return -FDT_ERR_BADSTRUCTURE;
                        name = fdt_get_name(fdt, offset, &len);
+                       if (!name)
+                               return len;
 
                        /* The root node must have an empty name */
                        if (!depth && *name)
@@ -563,6 +565,9 @@ int fdt_next_region(const void *fdt,
                        if (p.depth == FDT_MAX_DEPTH)
                                return -FDT_ERR_BADSTRUCTURE;
                        name = fdt_get_name(fdt, offset, &len);
+                       if (!name)
+                               return len;
+
                        if (p.end - path + 2 + len >= path_len)
                                return -FDT_ERR_NOSPACE;
 

diff --git a/scripts/dtc/libfdt/fdt_ro.c b/scripts/dtc/libfdt/fdt_ro.c
index 3e7e26b4398e0207bd49846a42c0262d7b97bfd2..d7b424c658f4f94d5e91d1e796686c9a88624971 100644 (file)
--- a/scripts/dtc/libfdt/fdt_ro.c
+++ b/scripts/dtc/libfdt/fdt_ro.c
@@ -940,6 +940,9 @@ int fdt_check_full(const void *fdt, size_t bufsize)
                                int len;
 
                                name = fdt_get_name(fdt, offset, &len);
+                               if (!name)
+                                       return len;
+
                                if (*name || len)
                                        return -FDT_ERR_BADLAYOUT;
                        }

diff --git a/tools/fdtgrep.c b/tools/fdtgrep.c
index b4c041070f560a8ca96120bd66640aec297f2fbb..dba7240001f969362edd504970ecc04320aaf4c8 100644 (file)
--- a/tools/fdtgrep.c
+++ b/tools/fdtgrep.c
@@ -355,6 +355,9 @@ static int display_fdt_by_regions(struct display_info *disp, const void *blob,
 
                case FDT_BEGIN_NODE:
                        name = fdt_get_name(blob, offset, &len);
+                       if (!name)
+                               return len;
+
                        fprintf(f, "%*s%s {", depth++ * shift, "",
                                *name ? name : "/");
                        break;