fit_image_get_data_size_unciphered() passes NULL as fdt_getprop()'s
length argument, so it accepts a 'data-size-unciphered' property of any
size and then dereferences the first four bytes of it. A property
shorter than that is read past its end, and the bytes that follow it in
the FIT are returned to the caller as the unciphered size.
Ask for the length and require it to be exactly one fdt32_t, as the
binding describes.
Fixes: 4df3578119b0 ("u-boot: fit: add support to decrypt fit with aes")
Signed-off-by: Pranav Rajendran <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
---
v2:
- Document the new -EINVAL return in the kernel-doc block above the
function, per Simon's review comment.
boot/image-fit.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/boot/image-fit.c b/boot/image-fit.c
index ef90c5abd18..872d71d2faf 100644
--- a/boot/image-fit.c
+++ b/boot/image-fit.c
@@ -1035,16 +1035,21 @@ int fit_image_get_data_size(const void *fit, int
noffset, int *data_size)
* returns:
* 0, on success
* -ENOENT if the property could not be found
+ * -EINVAL if the property is not exactly one fdt32_t long
*/
int fit_image_get_data_size_unciphered(const void *fit, int noffset,
size_t *data_size)
{
const fdt32_t *val;
+ int len;
- val = fdt_getprop(fit, noffset, "data-size-unciphered", NULL);
+ val = fdt_getprop(fit, noffset, "data-size-unciphered", &len);
if (!val)
return -ENOENT;
+ if (len != sizeof(*val))
+ return -EINVAL;
+
*data_size = (size_t)fdt32_to_cpu(*val);
return 0;
--
2.50.1 (Apple Git-155)
