[PATCH 09/11] boot: fit: share the external-data offset calculation

[Simon Glass]

Hi Daniel,

On 2026-10-14T08:38:38, Daniel Golle <daniel at makrotopia.org> wrote:
> boot: fit: share the external-data offset calculation
>
> fit_image_load_storage() repeats the data-position / data-offset /
> totalsize-alignment sequence that fit_image_get_data() performs, and
> writes the result through an int pointer where the getters expect a u32.
> The copy also omits the range check on the sum, so an offset that the
> embedded path rejects is accepted here.
>
> Extract fit_image_ext_data_offset() and call it from both. The storage
> path gains the range check and both agree on one expression for the
> alignment.
>
> Signed-off-by: Daniel Golle <daniel at makrotopia.org>
>
>  boot/image-fit.c | 82 +++++++++++++++++++++++++++++++++++---------------------
>  1 file changed, 51 insertions(+), 31 deletions(-)

> diff --git a/boot/image-fit.c b/boot/image-fit.c
> @@ -1056,6 +1056,47 @@ int fit_image_get_data_size_unciphered(const void *fit, int noffset,
> +static int fit_image_ext_data_offset(const void *fit, int noffset, u32 *offsetp)

The sibling getters are all fit_image_get_<thing>(), so
fit_image_get_ext_data_offset() would fit the pattern. What do you
think?

> diff --git a/boot/image-fit.c b/boot/image-fit.c
> @@ -1077,29 +1118,14 @@ int fit_image_get_data(const void *fit, int noffset, const void **data,
> +	ret = fit_image_ext_data_offset(fit, noffset, &offset);
> +	if (ret && ret != -ENOENT)
> +		return ret;
> +	external_data = !ret;

With the helper doing the work, 'external_data' only serves the
if/else below. Folding the embedded case into an early 'return
fit_image_get_emb_data(...)' on -ENOENT drops the local and leaves the
external path at the top level, which reads more clearly - up to you.

> diff --git a/boot/image-fit.c b/boot/image-fit.c
> @@ -2207,19 +2233,13 @@ static int fit_image_load_storage(struct bootm_headers *images, const void *fit,
> -	if (data_off < 0 || data_sz < 0)
> -		return -EINVAL;
> -
>  	fit_image_get_comp(fit, noffset, &img_comp);

Worth a sentence in the commit message that the signed-value guard
goes away too - it is dead once data_off / data_sz become u32, and the
UINT32_MAX check in the helper now covers data_off. Otherwise the hunk
looks like an unrelated removal.

Regards,
Simon