summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorKonrad Beckmann <konrad.beckmann@gmail.com>2018-11-07 14:51:46 -0500
committerTom Rini <trini@konsulko.com>2018-11-16 16:52:01 -0500
commit21ebf2adde3e0d2fb0b6e9d63bd62a6b2f4c30a1 (patch)
treecd0af77dfc2b34ebf26977b11dc2d7fdf7654502
parentf1c85688ab13f154ebe1b1480def233a22e7f66b (diff)
fdt_region: Ensure that depth never goes below -1
A specially crafted FIT image makes it possible to overflow the stack with controlled values when using the verified boot feature. Depending on the memory layout, this could be used to overwrite configuration variables on the heap and setting them to 0, e.g. disable signature verification, thus bypassing it. This change fixes a bug in fdt_find_regions where the fdt structure is parsed. A lower value than -1 of depth can lead to a buffer underflow write on the stack. Signed-off-by: Konrad Beckmann <konrad.beckmann@gmail.com> Reviewed-by: Simon Glass <sjg@chromium.org>
-rw-r--r--lib/libfdt/fdt_region.c3
1 files changed, 3 insertions, 0 deletions
diff --git a/lib/libfdt/fdt_region.c b/lib/libfdt/fdt_region.c
index d3b9a60e99..7e9fa9272e 100644
--- a/lib/libfdt/fdt_region.c
+++ b/lib/libfdt/fdt_region.c
@@ -96,6 +96,9 @@ int fdt_find_regions(const void *fdt, char * const inc[], int inc_count,
break;
case FDT_END_NODE:
+ /* Depth must never go below -1 */
+ if (depth < 0)
+ return -FDT_ERR_BADSTRUCTURE;
include = want;
want = stack[depth--];
while (end > path && *--end != '/')