Commit graph

6 commits

Author SHA1 Message Date
Simon Glass
8a7d4cf982 fdt_region: Check for a single root node of the correct name
At present fdt_find_regions() assumes that the FIT is a valid devicetree.
If the FIT has two root nodes this is currently not detected in this
function, nor does libfdt's fdt_check_full() notice. Also it is possible
for the root node to have a name even though it should not.

Add checks for these and return -FDT_ERR_BADSTRUCTURE if a problem is
detected.

CVE-2021-27097

Signed-off-by: Simon Glass <sjg@chromium.org>
Reported-by: Bruce Monroe <bruce.monroe@intel.com>
Reported-by: Arie Haenel <arie.haenel@intel.com>
Reported-by: Julien Lenoir <julien.lenoir@intel.com>
2021-02-15 19:17:18 -05:00
Philippe Reynes
e8781dcc89 lib: libfdt: fdt_region: avoid NULL pointer access
The function fdt_find_regions look in the exclude list for each
property, even if the name is NULL. It could happen if the fit
image is corrupted. On sandbox, it generates a segfault.

To avoid this issue, if the name of a property is NULL, we report
an error and avoid looking in the exclude list.

Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2020-07-25 14:46:57 -06:00
Tom Rini
7208396bbf Revert "Merge tag 'dm-pull-20jul20' of git://git.denx.de/u-boot-dm"
This reverts commit 5d3a21df66, reversing
changes made to 56d37f1c56.

Unfortunately this is causing CI failures:
https://travis-ci.org/github/trini/u-boot/jobs/711313649

Signed-off-by: Tom Rini <trini@konsulko.com>
2020-07-24 08:42:06 -04:00
Philippe Reynes
2a3be302d5 lib: libfdt: fdt_region: avoid NULL pointer access
The function fdt_find_regions look in the exclude list for each
property, even if the name is NULL. It could happen if the fit
image is corrupted. On sandbox, it generates a segfault.

To avoid this issue, if the name of a property is NULL, we report
an error and avoid looking in the exclude list.

Signed-off-by: Philippe Reynes <philippe.reynes@softathome.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
2020-07-20 11:37:47 -06:00
Simon Glass
4d72caa5b9 common: Drop image.h from common header
Move this uncommon header out of the common header.

Signed-off-by: Simon Glass <sjg@chromium.org>
2020-05-18 17:33:33 -04:00
Masahiro Yamada
64045a6a17 libfdt: split fdt_region declarations out to <fdt_region.h>
fdt_region APIs are not part of libfdt. They are U-Boot extension
for the verified boot. Split the declarations related to fdt_region
out of <fdt_region.h>. This allows <linux/libfdt.h> to become a
simple wrapper file, like Linux does.

Signed-off-by: Masahiro Yamada <masahiroy@kernel.org>
2020-04-26 14:24:08 -06:00