[PATCH v1 0/2] tools: mkimage: fix stale data pointer in fit_import_data()

[Aristo Chen]

fit_import_data() in tools/fit_image.c declares the data pointer and
the name of the external data property outside its loop over the
/images subnodes, so both values leak from one image into the next. An
image node that carries data-size but neither data-offset nor
data-position then reuses the pointer left behind by the previously
imported image: the previous image's data is written into the node,
after which the import aborts trying to delete an external data
property the node never had. Since that abort path only prints a
debug() message, a regular mkimage build fails with nothing but the
generic usage text. The failure mode also depends on the order of the
image nodes: when no externally stored image precedes the malformed
node, the pointer is still NULL, the node is skipped, and the hashing
stage reports a proper error instead.

A FIT authored from a .its cannot hit this, because dtc-authored
images carry inline data. It takes re-processing an external-data FIT
in which an image has lost its data-offset, for example one edited
with fdtput -d or produced by another tool:

  mkimage -E -f demo.its demo.itb
  fdtput -d demo.itb /images/kernel-2 data-offset
  mkimage -F demo.itb

There is no silent-success path, because the failing property delete
always aborts the run before the file is written back, but the user is
left without any indication of what is wrong.

Patch 1 moves the declarations into the loop so that each image starts
from a clean state. A node without an external data reference is now
skipped consistently regardless of node order, and the later
processing stages report the malformed node with a proper error
message (Can't get image data/size).

Patch 2 adds a regression test that builds an external-data FIT,
deletes the data-offset property of the second image and re-processes
the result with mkimage -F. It asserts that mkimage fails and that the
diagnostic is present on stderr; the unfixed tool fails the second
assertion since it prints nothing beyond the usage text.

Aristo Chen (2):
  tools: mkimage: fix stale data pointer in fit_import_data()
  test: py: add regression test for fit_import_data() stale state

 test/py/tests/test_fit_import_data.py | 89 +++++++++++++++++++++++++++
 tools/fit_image.c                     |  4 +-
 2 files changed, 91 insertions(+), 2 deletions(-)
 create mode 100644 test/py/tests/test_fit_import_data.py

-- 
2.43.0