From 6ef9a89c1da433108ac89deab58954c6e2b798ba Mon Sep 17 00:00:00 2001 From: Heinrich Schuchardt Date: Tue, 24 Jun 2025 17:34:30 +0200 Subject: [PATCH] common/spl: Revert fix potential out of buffer access in spl_fit_get_image_name function The change in commit 3704b888a4ca ("common/spl: fix potential out of buffer access in spl_fit_get_image_name function") led to function spl_fit_get_image_name() no longer detecting if a property does not exist at a non-zero buffer. Link: https://lore.kernel.org/u-boot/38f5d078-3328-4bdb-9c95-4fb5fe89ddc2@gmx.de/T/#m59f3a23e675daa992c28d12236de71cae2ca2bb9 Fixes: 3704b888a4ca ("common/spl: fix potential out of buffer access in spl_fit_get_image_name function") Signed-off-by: Heinrich Schuchardt Tested-by: E Shattow --- common/spl/spl_fit.c | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/common/spl/spl_fit.c b/common/spl/spl_fit.c index b3824af475f..e250c11ebbd 100644 --- a/common/spl/spl_fit.c +++ b/common/spl/spl_fit.c @@ -86,12 +86,11 @@ static int spl_fit_get_image_name(const struct spl_fit_info *ctx, str = name; for (i = 0; i < index; i++) { - str = memchr(str, '\0', name + len - str); - if (!str) { + str = strchr(str, '\0') + 1; + if (!str || (str - name >= len)) { found = false; break; } - str++; } if (!found && CONFIG_IS_ENABLED(SYSINFO) && !sysinfo_get(&sysinfo)) { -- 2.47.2