From 45be19a34acbef130ba317b18b9ba3fbcb76cb35 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Pierre-Cl=C3=A9ment=20Tosi?= Date: Tue, 10 Oct 2023 10:28:22 +0100 Subject: [PATCH] libfdt: fdt_path_offset_namelen: Reject empty path MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Reject empty paths and negative lengths, according to the DT spec v0.4: The convention for specifying a device path is: /node-name-1/node-name-2/node-name-N The path to the root node is /. This prevents the access to path[0] from ever being out-of-bounds. Signed-off-by: Pierre-Clément Tosi Message-ID: <20231010092822.qo2nxc3g47t26dqs@google.com> Signed-off-by: David Gibson --- cpukit/dtc/libfdt/fdt_ro.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/cpukit/dtc/libfdt/fdt_ro.c b/cpukit/dtc/libfdt/fdt_ro.c index 9fe2f49590..b78c4e48f1 100644 --- a/cpukit/dtc/libfdt/fdt_ro.c +++ b/cpukit/dtc/libfdt/fdt_ro.c @@ -255,6 +255,9 @@ int fdt_path_offset_namelen(const void *fdt, const char *path, int namelen) FDT_RO_PROBE(fdt); + if (!can_assume(VALID_INPUT) && namelen <= 0) + return -FDT_ERR_BADPATH; + /* see if we have an alias */ if (*path != '/') { const char *q = memchr(path, '/', end - p);