brain-hackers_pepepper-mirror/u-boot-brain
1
0
Fork 0
mirror of https://github.com/brain-hackers/u-boot-brain synced 2024-06-09 15:26:03 +09:00
Code Issues Projects Releases Wiki Activity

fdt_region: Ensure that depth never goes below -1

Browse Source 
A specially crafted FIT image makes it possible to overflow the stack
with controlled values when using the verified boot feature. Depending
on the memory layout, this could be used to overwrite configuration
variables on the heap and setting them to 0, e.g. disable signature
verification, thus bypassing it.

This change fixes a bug in fdt_find_regions where the fdt structure is
parsed. A lower value than -1 of depth can lead to a buffer underflow
write on the stack.

Signed-off-by: Konrad Beckmann <konrad.beckmann@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
This commit is contained in:
Konrad Beckmann 2018-11-07 14:51:46 -05:00 committed by Tom Rini
parent f1c85688ab
commit 21ebf2adde
1 changed files with 3 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
lib/libfdt/fdt_region.c
View File

@ -96,6 +96,9 @@ int fdt_find_regions(const void *fdt, char * const inc[], int inc_count,
break;
case FDT_END_NODE:
/* Depth must never go below -1 */
if (depth < 0)
return -FDT_ERR_BADSTRUCTURE;
include = want;
want = stack[depth--];
while (end > path && *--end != '/')