From 4ca61f84dc210ae78376d992c1ce6ebe40ecb5be Mon Sep 17 00:00:00 2001 From: Simon Glass Date: Tue, 23 Mar 2021 13:09:25 +1300 Subject: libfdt: Check that there is only one root node At present it is possible to have two root nodes and even access nodes in the 'second' root. Such trees should not be considered valid. This was discovered as part of a security investigation into U-Boot verified boot. Add a check for this to fdt_check_full(). Signed-off-by: Simon Glass Reported-by: Arie Haenel Reported-by: Julien Lenoir Message-Id: <20210323000926.3210733-1-sjg@chromium.org> Signed-off-by: David Gibson --- libfdt/fdt_check.c | 7 +++++++ 1 file changed, 7 insertions(+) (limited to 'libfdt') diff --git a/libfdt/fdt_check.c b/libfdt/fdt_check.c index 9ddfdbf..13595a2 100644 --- a/libfdt/fdt_check.c +++ b/libfdt/fdt_check.c @@ -19,6 +19,7 @@ int fdt_check_full(const void *fdt, size_t bufsize) unsigned int depth = 0; const void *prop; const char *propname; + bool expect_end = false; if (bufsize < FDT_V1_SIZE) return -FDT_ERR_TRUNCATED; @@ -41,6 +42,10 @@ int fdt_check_full(const void *fdt, size_t bufsize) if (nextoffset < 0) return nextoffset; + /* If we see two root nodes, something is wrong */ + if (expect_end && tag != FDT_END) + return -FDT_ERR_BADSTRUCTURE; + switch (tag) { case FDT_NOP: break; @@ -60,6 +65,8 @@ int fdt_check_full(const void *fdt, size_t bufsize) if (depth == 0) return -FDT_ERR_BADSTRUCTURE; depth--; + if (depth == 0) + expect_end = true; break; case FDT_PROP: -- cgit v1.1