len0rd/dtc
1
0
Fork 0
mirror of https://github.com/dgibson/dtc.git synced 2025-10-13 08:17:40 -04:00
Code Issues Projects Releases Packages Wiki Activity Actions

libfdt: fdt_get_alias_namelen: Validate aliases

Browse source 
Ensure that the alias found matches the device tree specification v0.4:

    Each property of the /aliases node defines an alias. The property
    name specifies the alias name. The property value specifies the full
    path to a node in the devicetree.

This protects against a stack overflow caused by

    fdt_path_offset_namelen(fdt, path, namelen)

calling

    fdt_path_offset(fdt, fdt_get_alias_namelen(fdt, path, namelen))

leading to infinite recursion on DTs with "circular" aliases.

This fix was originally written by Mike McTernan for Android in [1].

[1]: https://android.googlesource.com/platform/external/dtc/+/9308e7f9772bd226fea9925b1fc4d53c127ed4d5

Signed-off-by: Pierre-Clément Tosi <ptosi@google.com>
Acked-by: Mike McTernan <mikemcternan@google.com>
Message-ID: <20231010092725.63h7c45p2fnmj577@google.com>
Signed-off-by: David Gibson <david@gibson.dropbear.id.au>
This commit is contained in:
Pierre-Clément Tosi 2023-10-10 10:27:25 +01:00 • committed by David Gibson
parent 52157f13ef
commit 79b9e326a1
3 changed files with 27 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

11
libfdt/fdt_ro.c
View file

@ -537,7 +537,16 @@ static const void *fdt_path_getprop_namelen(const void *fdt, const char *path,
const char *fdt_get_alias_namelen(const void *fdt,
const char *name, int namelen)
{
return fdt_path_getprop_namelen(fdt, "/aliases", name, namelen, NULL);
int len;
const char *alias;
alias = fdt_path_getprop_namelen(fdt, "/aliases", name, namelen, &len);
if (!can_assume(VALID_DTB) &&
!(alias && len > 0 && alias[len - 1] == '\0' && *alias == '/'))
return NULL;
return alias;
}
const char *fdt_get_alias(const void *fdt, const char *name)

4
tests/aliases.dts
View file

@ -5,6 +5,10 @@
#size-cells = <0>;
aliases {
empty = "";
loop = "loop";
nonull = [626164];
relative = "s1/subsubnode";
s1 = &sub1;
ss1 = &subsub1;
sss1 = &subsubsub1;

14
tests/get_alias.c
View file

@ -21,9 +21,16 @@ static void check_alias(void *fdt, const char *path, const char *alias)
aliaspath = fdt_get_alias(fdt, alias);
if (path && !aliaspath)
if (!path && !aliaspath)
return;
if (!aliaspath)
FAIL("fdt_get_alias(%s) failed\n", alias);
if (!path)
FAIL("fdt_get_alias(%s) returned %s instead of NULL",
alias, aliaspath);
if (strcmp(aliaspath, path) != 0)
FAIL("fdt_get_alias(%s) returned %s instead of %s\n",
alias, aliaspath, path);
@ -36,9 +43,14 @@ int main(int argc, char *argv[])
test_init(argc, argv);
fdt = load_blob_arg(argc, argv);
check_alias(fdt, NULL, "empty");
check_alias(fdt, NULL, "nonull");
check_alias(fdt, NULL, "relative");
check_alias(fdt, "/subnode@1", "s1");
check_alias(fdt, "/subnode@1/subsubnode", "ss1");
check_alias(fdt, "/subnode@1/subsubnode/subsubsubnode", "sss1");
check_alias(fdt, NULL, "loop"); // Might trigger a stack overflow
PASS();
}