[PATCH 1/1] libfdt: error handling fdt_open_into()

[Heinrich Schuchardt]

On 10/28/26 01:21, Heinrich Schuchardt wrote:
> fdt_num_mem_rsv() may return -FDT_ERR_TRUNCATED.
> 
> fdt_open_into() should handle this error condition instead of blindly
> continuing.
> 
> Addresses-Coverity-ID: ("1595097 Overflowed integer argument")
> Fixes: e2ce15cb3be9 ("platform: Add libfdt support.")
> Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt at canonical.com>

We should better apply the upstream fix which corrects more issues:

47d7c01ba8a1 ("libfdt: Fix bugs with unchecked usage of fdt_num_mem_rsv()")

Or should we upgrade the whole of libfdt to v1.8.1?

Best regards

Heinrich

> ---
>   lib/utils/libfdt/fdt_rw.c | 5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
> 
> diff --git a/lib/utils/libfdt/fdt_rw.c b/lib/utils/libfdt/fdt_rw.c
> index b3b8e73c..207b5ffc 100644
> --- a/lib/utils/libfdt/fdt_rw.c
> +++ b/lib/utils/libfdt/fdt_rw.c
> @@ -427,7 +427,10 @@ int fdt_open_into(const void *fdt, void *buf, int bufsize)
>   
>   	FDT_RO_PROBE(fdt);
>   
> -	mem_rsv_size = (fdt_num_mem_rsv(fdt)+1)
> +	mem_rsv_size = fdt_num_mem_rsv(fdt);
> +	if (mem_rsv_size < 0)
> +		return mem_rsv_size;
> +	mem_rsv_size = (mem_rsv_size + 1)
>   		* sizeof(struct fdt_reserve_entry);
>   
>   	if (can_assume(LATEST) || fdt_version(fdt) >= 17) {