common/spl: guard against buffer overflow in spl_fit_get_image_name()
A malformed FIT image could have an image name property that is not NUL
terminated. Reject such images.
Reported-by: Mikhail Kshevetskiy <mikhail.kshevetskiy@iopsys.eu>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
Tested-by: E Shattow <e@freeshell.de>
diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c
index e250c11..25f3c82 100644
--- a/common/spl/spl_fit.c
+++ b/common/spl/spl_fit.c
@@ -73,7 +73,7 @@
const char **outname)
{
struct udevice *sysinfo;
- const char *name, *str;
+ const char *name, *str, *end;
__maybe_unused int node;
int len, i;
bool found = true;
@@ -83,11 +83,17 @@
debug("cannot find property '%s': %d\n", type, len);
return -EINVAL;
}
+ /* A string property should be NUL terminated */
+ end = name + len - 1;
+ if (!len || *end) {
+ debug("malformed property '%s'\n", type);
+ return -EINVAL;
+ }
str = name;
for (i = 0; i < index; i++) {
str = strchr(str, '\0') + 1;
- if (!str || (str - name >= len)) {
+ if (str > end) {
found = false;
break;
}