diff --git a/common/Kconfig.boot b/common/Kconfig.boot
index f23b998..9b84a8d 100644
--- a/common/Kconfig.boot
+++ b/common/Kconfig.boot
@@ -165,6 +165,16 @@
 	select SPL_IMAGE_SIGN_INFO
 	select SPL_FIT_FULL_CHECK
 
+config SPL_FIT_SIGNATURE_MAX_SIZE
+	hex "Max size of signed FIT structures in SPL"
+	depends on SPL_FIT_SIGNATURE
+	default 0x10000000
+	help
+	  This option sets a max size in bytes for verified FIT uImages.
+	  A sane value of 256MB protects corrupted DTB structures from overlapping
+	  device memory. Assure this size does not extend past expected storage
+	  space.
+
 config SPL_LOAD_FIT
 	bool "Enable SPL loading U-Boot as a FIT (basic fitImage features)"
 	select SPL_FIT
diff --git a/common/image-fit-sig.c b/common/image-fit-sig.c
index e95e64b..4edebbf 100644
--- a/common/image-fit-sig.c
+++ b/common/image-fit-sig.c
@@ -49,10 +49,8 @@
 	 * Use malloc() except in SPL (to save code size). In SPL the caller
 	 * must allocate the array.
 	 */
-#ifndef CONFIG_SPL_BUILD
-	if (!region)
+	if (!IS_ENABLED(CONFIG_SPL_BUILD) && !region)
 		region = calloc(sizeof(*region), count);
-#endif
 	if (!region)
 		return NULL;
 	for (i = 0; i < count; i++) {
@@ -72,12 +70,10 @@
 	char *algo_name;
 	const char *padding_name;
 
-#ifndef USE_HOSTCC
-	if (fdt_totalsize(fit) > CONFIG_FIT_SIGNATURE_MAX_SIZE) {
+	if (fdt_totalsize(fit) > CONFIG_VAL(FIT_SIGNATURE_MAX_SIZE)) {
 		*err_msgp = "Total size too large";
 		return 1;
 	}
-#endif
 	if (fit_image_hash_get_algo(fit, noffset, &algo_name)) {
 		*err_msgp = "Can't get hash algo property";
 		return -1;
diff --git a/common/image-fit.c b/common/image-fit.c
index 1e4099d..33b4a46 100644
--- a/common/image-fit.c
+++ b/common/image-fit.c
@@ -2009,9 +2009,6 @@
 	int type_ok, os_ok;
 	ulong load, load_end, data, len;
 	uint8_t os, comp;
-#ifndef USE_HOSTCC
-	uint8_t os_arch;
-#endif
 	const char *prop_name;
 	int ret;
 
@@ -2103,8 +2100,12 @@
 	}
 
 #ifndef USE_HOSTCC
+	{
+	uint8_t os_arch;
+
 	fit_image_get_arch(fit, noffset, &os_arch);
 	images->os.arch = os_arch;
+	}
 #endif
 
 	bootstage_mark(bootstage_id + BOOTSTAGE_SUB_CHECK_ALL);