From 8a52418e9a34c962a6e3688263f7c37aec5946f6 Mon Sep 17 00:00:00 2001 From: Yu-Ping Wu Date: Tue, 26 Aug 2025 16:43:03 +0800 Subject: [PATCH] commonlib/device_tree: Fix memory leak in fdt_unflatten() When the passed `blob` is not a valid FDT, the memory allocated for `tree` should be freed. Move the allocation after the fdt_is_valid() check to avoid the problem. Also remove the unnecessary cast to 'const struct fdt_header *'. Change-Id: If591172cd511ae2a1ca9c26f2addef8d67fd0b69 Signed-off-by: Yu-Ping Wu Reviewed-on: https://review.coreboot.org/c/coreboot/+/88948 Reviewed-by: Nicholas Sudsgaard Reviewed-by: Paul Menzel Tested-by: build bot (Jenkins) Reviewed-by: Patrick Rudolph --- src/commonlib/device_tree.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/src/commonlib/device_tree.c b/src/commonlib/device_tree.c index fb1e78f590..a6fdd0cb61 100644 --- a/src/commonlib/device_tree.c +++ b/src/commonlib/device_tree.c @@ -766,13 +766,13 @@ bool fdt_is_valid(const void *blob) struct device_tree *fdt_unflatten(const void *blob) { - struct device_tree *tree = xzalloc(sizeof(*tree)); - const struct fdt_header *header = (const struct fdt_header *)blob; - tree->header = header; - if (!fdt_is_valid(blob)) return NULL; + const struct fdt_header *header = blob; + struct device_tree *tree = xzalloc(sizeof(*tree)); + tree->header = header; + uint32_t struct_offset = be32toh(header->structure_offset); uint32_t strings_offset = be32toh(header->strings_offset); uint32_t reserve_offset = be32toh(header->reserve_map_offset);