From c8d51b38ba9c127a69749562c1ef0c19584d4b5d Mon Sep 17 00:00:00 2001 From: Wang Han <416810799@qq.com> Date: Sun, 2 Nov 2025 15:21:26 +0800 Subject: [PATCH] Enhance fdt_header validation for empty dtb --- native/src/boot/bootimg.cpp | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/native/src/boot/bootimg.cpp b/native/src/boot/bootimg.cpp index 1e4416208..b584c9736 100644 --- a/native/src/boot/bootimg.cpp +++ b/native/src/boot/bootimg.cpp @@ -279,9 +279,10 @@ static int find_dtb_offset(const uint8_t *buf, unsigned sz) { auto fdt_hdr = reinterpret_cast(curr); - // Check that fdt_header.totalsize does not overflow kernel image size + // Check that fdt_header.totalsize does not overflow kernel image size or is empty dtb + // https://github.com/torvalds/linux/commit/7b937cc243e5b1df8780a0aa743ce800df6c68d1 uint32_t totalsize = fdt_hdr->totalsize; - if (totalsize > end - curr) + if (totalsize > end - curr || totalsize <= 0x48) continue; // Check that fdt_header.off_dt_struct does not overflow kernel image size