Hi Pranav,
On 2026-08-15T22:07:52, Pranav Rajendran <[email protected]> wrote:
> image-fit: check the length of the data-size-unciphered property
>
> fit_image_get_data_size_unciphered() passes NULL as fdt_getprop()'s
> length argument, so it accepts a 'data-size-unciphered' property of any
> size and then dereferences the first four bytes of it. A property
> shorter than that is read past its end, and the bytes that follow it in
> the FIT are returned to the caller as the unciphered size.
>
> Ask for the length and require it to be exactly one fdt32_t, as the
> binding describes.
>
> Fixes: 4df3578119b0 ("u-boot: fit: add support to decrypt fit with aes")
> Signed-off-by: Pranav Rajendran <[email protected]>
>
> boot/image-fit.c | 6 +++++-
> 1 file changed, 5 insertions(+), 1 deletion(-)
> diff --git a/boot/image-fit.c b/boot/image-fit.c
> @@ -1040,11 +1040,15 @@ int fit_image_get_data_size_unciphered(const void
> *fit, int noffset,
> size_t *data_size)
> {
> const fdt32_t *val;
> + int len;
>
> - val = fdt_getprop(fit, noffset, "data-size-unciphered", NULL);
> + val = fdt_getprop(fit, noffset, "data-size-unciphered", &len);
> if (!val)
> return -ENOENT;
>
> + if (len != sizeof(*val))
> + return -EINVAL;
> +
> *data_size = (size_t)fdt32_to_cpu(*val);
Please add -EINVAL to the kernel-doc block above so the contract
matches the code. Otherwise this looks right.
With that:
Reviewed-by: Simon Glass <[email protected]>
Regards,
Simon
