We should check that we have at least a FDT header before dereferencing
pointers to the structure. Issue detected with libfuzzer.
Signed-off-by: Ahmad Fatoum <a.fat...@pengutronix.de>
---
v1 -> v2:
- new patch
---
common/state/backend_format_dtb.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/common/state/backend_format_dtb.c
b/common/state/backend_format_dtb.c
index b41b896aaced..9624d1e8103e 100644
--- a/common/state/backend_format_dtb.c
+++ b/common/state/backend_format_dtb.c
@@ -45,9 +45,13 @@ static int state_backend_format_dtb_verify(struct
state_backend_format *format,
struct state_backend_format_dtb *fdtb = get_format_dtb(format);
struct device_node *root;
struct fdt_header *fdt = (struct fdt_header *)buf;
- size_t dtb_len = fdt32_to_cpu(fdt->totalsize);
+ size_t dtb_len;
size_t len = *lenp;
+ if (len < sizeof(*fdt))
+ return -EINVAL;
+
+ dtb_len = fdt32_to_cpu(fdt->totalsize);
if (dtb_len > len) {
dev_err(fdtb->dev, "Error, stored DTB length (%zd) longer than
read buffer (%zd)\n",
dtb_len, len);
--
2.39.5
