commit 14f8b87308455fce6ab72cf86adccb335a28abeb
author Mike McTernan <mikemcternan@google.com> Wed Sep 28 13:42:30 2022 +0100
committer Mike McTernan <mikemcternan@google.com> Thu Sep 29 14:48:00 2022 +0000
tree a56ffe61de902290b9f93461ea76d10ef68c5cd4
parent 234b63776ec124bbd9f5e19b7fd1504966e2703a

Fix potential invalid root node from fdt_to_ufdt_tree() causing OOB access.

Ignore-AOSP-First: Security
Bug: 248085351
Test: mmma system/libufdt && system/libufdt/tests/run_tests.sh
Test: mmma system/libufdt && system/libufdt/tests/run_performance_test.sh
Test: Run fuzz reproducer.
Test: Run fuzzer for 1 hour with 32 jobs.
Change-Id: Idf4f87d45d9ce947a2e7508e5e2eb025b279c514
Merged-In: Idf4f87d45d9ce947a2e7508e5e2eb025b279c514
(cherry picked from commit b70383d8af4586a5fa8b16b54c43454bf155c215)

ufdt_convert.c

diff --git a/ufdt_convert.c b/ufdt_convert.c
index 1e98008..9e7922a 100644
--- a/ufdt_convert.c
+++ b/ufdt_convert.c
@@ -300,9 +300,16 @@
     return ufdt_construct(NULL, pool);
   }
 
-  struct ufdt *res_tree = ufdt_construct(fdtp, pool);
   int end_offset;
   int start_tag = fdt_next_tag(fdtp, start_offset, &end_offset);
+
+  if (start_tag != FDT_BEGIN_NODE) {
+    return ufdt_construct(NULL, pool);
+  }
+
+  struct ufdt *res_tree = ufdt_construct(fdtp, pool);
+  if (res_tree == NULL) return NULL;
+
   res_tree->root =
       fdt_to_ufdt_tree(fdtp, start_offset, &end_offset, start_tag, pool);