Skip to content

Commit c0c2e11

Browse files
yujincheng08dgibson
authored andcommitted
Fix a UB when fdt_get_string return null
When fdt_get_string return null, `namep` is not correctly reset. From the document of `fdt_getprop_by_offset`, the parameter `namep` will be always overwritten (that is, it will be overwritten without exception of error occurance). As for the caller (like https://github.com/topjohnwu/Magisk/blob/e097c097feb881f6097b6d1dc346f310bc92f5d6/native/jni/magiskboot/dtb.cpp#L42), the code may be like: ```cpp size_t size; const char *name; auto *value = fdt_getprop_by_offset(fdt, prop, &name, &size); ``` and if `value == nullptr`, `size` is also be overwritten correctly but `name` is not, which is quite inconsistent. This commit makes sure `name` and `size` behavior consistently (reset to reasonable value) when error occurs. Signed-off-by: LoveSy <[email protected]> Signed-off-by: David Gibson <[email protected]>
1 parent cd5f69c commit c0c2e11

File tree

1 file changed

+1
-1
lines changed

1 file changed

+1
-1
lines changed

libfdt/fdt_ro.c

+1-1
Original file line numberDiff line numberDiff line change
@@ -481,12 +481,12 @@ const void *fdt_getprop_by_offset(const void *fdt, int offset,
481481
if (!can_assume(VALID_INPUT)) {
482482
name = fdt_get_string(fdt, fdt32_ld_(&prop->nameoff),
483483
&namelen);
484+
*namep = name;
484485
if (!name) {
485486
if (lenp)
486487
*lenp = namelen;
487488
return NULL;
488489
}
489-
*namep = name;
490490
} else {
491491
*namep = fdt_string(fdt, fdt32_ld_(&prop->nameoff));
492492
}

0 commit comments

Comments
 (0)