The boot wrapper reads alias, stdout-path, and device_type properties
with getprop() and then passes them to finddevice() and strcmp() as C
strings. getprop() reports a length but does not append a trailing NUL,
so these lookups can run past the fixed stack buffers.

Introduce a small boot-side string helper and make it reject properties
that do not fit in their destination buffers.

Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
---
 arch/powerpc/boot/ops.h    | 25 ++++++++++++++++++++++++-
 arch/powerpc/boot/serial.c |  7 ++++---
 2 files changed, 28 insertions(+), 4 deletions(-)

diff --git a/arch/powerpc/boot/ops.h b/arch/powerpc/boot/ops.h
index a40c2162a4e9..06149b4f2555 100644
--- a/arch/powerpc/boot/ops.h
+++ b/arch/powerpc/boot/ops.h
@@ -106,6 +106,29 @@ static inline int getprop(void *devp, const char *name, void *buf, int buflen)
 	return (dt_ops.getprop) ? dt_ops.getprop(devp, name, buf, buflen) : -1;
 }
 
+static inline int getprop_str(void *devp, const char *name, char *buf,
+			      int buflen)
+{
+	int len;
+
+	if (buflen <= 0)
+		return -1;
+
+	len = getprop(devp, name, buf, buflen);
+	if (len <= 0) {
+		buf[0] = '\0';
+		return len;
+	}
+
+	if (len >= buflen) {
+		buf[buflen - 1] = '\0';
+		return -1;
+	}
+	buf[len] = '\0';
+
+	return len;
+}
+
 static inline int setprop(void *devp, const char *name,
                           const void *buf, int buflen)
 {
@@ -172,7 +195,7 @@ static inline void *find_node_by_alias(const char *alias)
 
 	if (devp) {
 		char path[MAX_PATH_LEN];
-		if (getprop(devp, alias, path, MAX_PATH_LEN) > 0)
+		if (getprop_str(devp, alias, path, MAX_PATH_LEN) > 0)
 			return finddevice(path);
 	}
 
diff --git a/arch/powerpc/boot/serial.c b/arch/powerpc/boot/serial.c
index c6d32a8c3612..074e69d66974 100644
--- a/arch/powerpc/boot/serial.c
+++ b/arch/powerpc/boot/serial.c
@@ -90,13 +90,14 @@ static void *serial_get_stdout_devp(void)
 	if (devp == NULL)
 		goto err_out;
 
-	if (getprop(devp, "linux,stdout-path", path, MAX_PATH_LEN) > 0 ||
-		getprop(devp, "stdout-path", path, MAX_PATH_LEN) > 0) {
+	if (getprop_str(devp, "linux,stdout-path", path, MAX_PATH_LEN) > 0 ||
+	    getprop_str(devp, "stdout-path", path, MAX_PATH_LEN) > 0) {
 		devp = finddevice(path);
 		if (devp == NULL)
 			goto err_out;
 
-		if ((getprop(devp, "device_type", devtype, sizeof(devtype)) > 0)
+		if ((getprop_str(devp, "device_type", devtype,
+				 sizeof(devtype)) > 0)
 				&& !strcmp(devtype, "serial"))
 			return devp;
 	}
-- 
2.50.1 (Apple Git-155)