On 6/24/25 08:34, Heinrich Schuchardt wrote:
> The change in commit 3704b888a4ca ("common/spl: fix potential out of buffer
> access in spl_fit_get_image_name function") led to function
> spl_fit_get_image_name() no longer detecting if a property does not exist
> at a non-zero buffer.
>
> Link:
> https://lore.kernel.org/u-boot/[email protected]/T/#m59f3a23e675daa992c28d12236de71cae2ca2bb9
> Fixes: 3704b888a4ca ("common/spl: fix potential out of buffer access in
> spl_fit_get_image_name function")
> Signed-off-by: Heinrich Schuchardt <[email protected]>
> ---
> common/spl/spl_fit.c | 5 ++---
> 1 file changed, 2 insertions(+), 3 deletions(-)
>
> diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c
> index b3824af475f..e250c11ebbd 100644
> --- a/common/spl/spl_fit.c
> +++ b/common/spl/spl_fit.c
> @@ -86,12 +86,11 @@ static int spl_fit_get_image_name(const struct
> spl_fit_info *ctx,
>
> str = name;
> for (i = 0; i < index; i++) {
> - str = memchr(str, '\0', name + len - str);
> - if (!str) {
> + str = strchr(str, '\0') + 1;
> + if (!str || (str - name >= len)) {
> found = false;
> break;
> }
> - str++;
> }
>
> if (!found && CONFIG_IS_ENABLED(SYSINFO) && !sysinfo_get(&sysinfo)) {
Tested-by: E Shattow <[email protected]>
