[PATCH v2 2/2] state: dtb: enforce minimum FDT length

[Ahmad Fatoum]

We should check that we have at least a FDT header before dereferencing
pointers to the structure. Issue detected with libfuzzer.

Signed-off-by: Ahmad Fatoum <a.fatoum at pengutronix.de>
---
v1 -> v2:
  - new patch
---
 common/state/backend_format_dtb.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/common/state/backend_format_dtb.c b/common/state/backend_format_dtb.c
index b41b896aaced..9624d1e8103e 100644
--- a/common/state/backend_format_dtb.c
+++ b/common/state/backend_format_dtb.c
@@ -45,9 +45,13 @@ static int state_backend_format_dtb_verify(struct state_backend_format *format,
 	struct state_backend_format_dtb *fdtb = get_format_dtb(format);
 	struct device_node *root;
 	struct fdt_header *fdt = (struct fdt_header *)buf;
-	size_t dtb_len = fdt32_to_cpu(fdt->totalsize);
+	size_t dtb_len;
 	size_t len = *lenp;
 
+	if (len < sizeof(*fdt))
+		return -EINVAL;
+
+	dtb_len = fdt32_to_cpu(fdt->totalsize);
 	if (dtb_len > len) {
 		dev_err(fdtb->dev, "Error, stored DTB length (%zd) longer than read buffer (%zd)\n",
 			dtb_len, len);
-- 
2.39.5