diff options
| author | Mike McTernan <mikemcternan@google.com> | 2022-09-14 15:21:40 +0100 |
|---|---|---|
| committer | Mike McTernan <mikemcternan@google.com> | 2022-09-26 09:50:23 +0000 |
| commit | 234b63776ec124bbd9f5e19b7fd1504966e2703a (patch) | |
| tree | d6fcedc2692d33615679da667decf73342fee8d5 | |
| parent | 9663f787f76cc537e1162fbc7e2448cf66e056cd (diff) | |
| download | libufdt-234b63776ec124bbd9f5e19b7fd1504966e2703a.tar.gz | |
Fix handling of invalid alias property values.
Bug: 246194233
Test: mmma system/libufdt && system/libufdt/tests/run_tests.sh
Test: mmma system/libufdt && system/libufdt/tests/run_performance_test.sh
Test: test with fuzzer case
Test: run fuzzer to check coverage beyond added checks
Ignore-AOSP-First: Security
Change-Id: I229cd2ff97a1bea807fdb9d0f4642af5219fc0af
(cherry picked from commit 7c57a20a9c74216fece757537f5d4e9115b3a904)
| -rw-r--r-- | ufdt_convert.c | 14 |
1 files changed, 11 insertions, 3 deletions
diff --git a/ufdt_convert.c b/ufdt_convert.c index 5c69f1f..1e98008 100644 --- a/ufdt_convert.c +++ b/ufdt_convert.c @@ -196,13 +196,21 @@ struct ufdt_node *ufdt_get_node_by_path_len(struct ufdt *tree, const char *path, const char *alias_path = ufdt_node_get_fdt_prop_data(aliases_node, &path_len); - if (alias_path == NULL) { - dto_error("Failed to find alias %s\n", path); + if (alias_path == NULL || path_len == 0) { + dto_error("Failed to find valid alias %s\n", path); + return NULL; + } + + /* property data must be a nul terminated string */ + int alias_len = strnlen(alias_path, path_len); + + if (alias_len != path_len - 1 || alias_len == 0) { + dto_error("Invalid alias for %s\n", path); return NULL; } struct ufdt_node *target_node = - ufdt_node_get_node_by_path_len(tree->root, alias_path, path_len); + ufdt_node_get_node_by_path_len(tree->root, alias_path, alias_len); return ufdt_node_get_node_by_path_len(target_node, next_slash, end - next_slash); |