libfdt: Fix bugs with unchecked usage of fdt_num_mem_rsv()
Some checks failed
Build test / build-make (alpine) (push) Has been cancelled
Build test / build-make (archlinux) (push) Has been cancelled
Build test / build-make (fedora) (push) Has been cancelled
Build test / build-make (ubuntu) (push) Has been cancelled
Build test / build-meson (alpine) (push) Has been cancelled
Build test / build-meson (archlinux) (push) Has been cancelled
Build test / build-meson (fedora) (push) Has been cancelled
Build test / build-meson (ubuntu) (push) Has been cancelled
Build test / clang64 (push) Has been cancelled
Build test / mingw32 (push) Has been cancelled
Build test / mingw64 (push) Has been cancelled
Build test / ucrt64 (push) Has been cancelled

fdt_num_mem_rsv() can return an error if the memory reservation block
is not properly terminated with a (0, 0) entry.  However several other
places in libfdt called it without checking for error returns, and could
therefore return strange results, or in the case of fdt_open_into()
crash.

Fix this by always checking the return value.  Add some addition tests to
catch this bug.

Reported-by: Moshe Strauss <moshestrauss10@gmail.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
This commit is contained in:
David Gibson 2026-04-17 20:36:42 +10:00
parent f551be7b39
commit 47d7c01ba8
11 changed files with 127 additions and 9 deletions

View file

@ -15,9 +15,12 @@
#include "tests.h"
#include "testdata.h"
#define SPACE 65536
int main(int argc, char *argv[])
{
void *fdt = &truncated_memrsv;
void *buf;
int err;
uint64_t addr, size;
@ -46,5 +49,11 @@ int main(int argc, char *argv[])
FAIL("fdt_get_mem_rsv(1) returned %d instead of -FDT_ERR_BADOFFSET",
err);
buf = xmalloc(SPACE);
err = fdt_open_into(fdt, buf, SPACE);
if (err != -FDT_ERR_TRUNCATED)
FAIL("fdt_open_into() returned %d instead of -FDT_ERR_TRUNCATED",
err);
PASS();
}