13 Nov
2018
13 Nov
'18
8:54 p.m.
On 7 November 2018 at 11:51, Tom Rini trini@konsulko.com wrote:
From: Konrad Beckmann konrad.beckmann@gmail.com
A specially crafted FIT image makes it possible to overflow the stack with controlled values when using the verified boot feature. Depending on the memory layout, this could be used to overwrite configuration variables on the heap and setting them to 0, e.g. disable signature verification, thus bypassing it.
This change fixes a bug in fdt_find_regions where the fdt structure is parsed. A lower value than -1 of depth can lead to a buffer underflow write on the stack.
Signed-off-by: Konrad Beckmann konrad.beckmann@gmail.com
lib/libfdt/fdt_region.c | 3 +++ 1 file changed, 3 insertions(+)
Reviewed-by: Simon Glass sjg@chromium.org