While fuzzing, the name marked by FDT_BEGIN_NODE sometimes extends beyond
the struct block area, Causing a heap-overflow.
Since `maxlen` is an unsigned integer representing the length of name,
It can be negative, So it overflows to large numbers, Causing strnlen()
to overflow.
So we can just change the type of maxlen to signed and check if it's negative.
Signed-off-by: Abdelrahman Youssef <abdelrahmanyossef12@xxxxxxxxx>
---
drivers/of/fdt.c | 7 ++++++-
1 file changed, 6 insertions(+), 1 deletion(-)
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 2c3ea31394..d8d8a4922c 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -176,7 +176,7 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
void *dt_strings;
struct fdt_header f;
int ret;
- unsigned int maxlen;
+ int maxlen;
const struct fdt_header *fdt = infdt;
ret = fdt_parse_header(infdt, size, &f);
@@ -210,6 +210,11 @@ static struct device_node *__of_unflatten_dtb(const void *infdt, int size,
maxlen = (unsigned long)fdt + f.off_dt_struct +
f.size_dt_struct - (unsigned long)name;
+ if (maxlen < 0) {
+ ret = -ESPIPE;
+ goto err;
+ }
+
len = strnlen(name, maxlen + 1);
if (len > maxlen) {
ret = -ESPIPE;
--
2.43.0
