Re: [PATCH v1 2/3] image-fit: check the length of the data-size-unciphered property

Hi Pranav,

On 2026-08-15T22:07:52, Pranav Rajendran <[email protected]> wrote:
> image-fit: check the length of the data-size-unciphered property
>
> fit_image_get_data_size_unciphered() passes NULL as fdt_getprop()'s
> length argument, so it accepts a 'data-size-unciphered' property of any
> size and then dereferences the first four bytes of it. A property
> shorter than that is read past its end, and the bytes that follow it in
> the FIT are returned to the caller as the unciphered size.
>
> Ask for the length and require it to be exactly one fdt32_t, as the
> binding describes.
>
> Fixes: 4df3578119b0 ("u-boot: fit: add support to decrypt fit with aes")
> Signed-off-by: Pranav Rajendran <[email protected]>
>
> boot/image-fit.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)

> diff --git a/boot/image-fit.c b/boot/image-fit.c
> @@ -1040,11 +1040,15 @@ int fit_image_get_data_size_unciphered(const void *fit, int noffset,
>                                      size_t *data_size)
>  {
>       const fdt32_t *val;
> +     int len;
>
> -     val = fdt_getprop(fit, noffset, "data-size-unciphered", NULL);
> +     val = fdt_getprop(fit, noffset, "data-size-unciphered", &len);
>       if (!val)
>               return -ENOENT;
>
> +     if (len != sizeof(*val))
> +             return -EINVAL;
> +
>       *data_size = (size_t)fdt32_to_cpu(*val);

Please add -EINVAL to the kernel-doc block above so the contract
matches the code. Otherwise this looks right.

With that:

Reviewed-by: Simon Glass <[email protected]>

Regards,
Simon