diff mbox series

kwbimage: Fix out of bounds access

Message ID 20180315101419.38387-1-agraf@suse.de
State Accepted
Commit 6cd5678c45e7b684e7af88c256cdacd03a76fb1c
Headers show
Series kwbimage: Fix out of bounds access | expand

Commit Message

Alexander Graf March 15, 2018, 10:14 a.m. UTC
The kwbimage format is reading beyond its header structure if it
misdetects a Xilinx Zynq image and tries to read it. Fix it by
sanity checking that the header we want to read fits inside our
file size.

Signed-off-by: Alexander Graf <agraf@suse.de>
---
 tools/kwbimage.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Michal Simek March 15, 2018, 10:53 a.m. UTC | #1
On 15.3.2018 11:14, Alexander Graf wrote:
> The kwbimage format is reading beyond its header structure if it
> misdetects a Xilinx Zynq image and tries to read it. Fix it by
> sanity checking that the header we want to read fits inside our
> file size.
> 
> Signed-off-by: Alexander Graf <agraf@suse.de>
> ---
>  tools/kwbimage.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/tools/kwbimage.c b/tools/kwbimage.c
> index 3ca3b3b4a6..26686ad30f 100644
> --- a/tools/kwbimage.c
> +++ b/tools/kwbimage.c
> @@ -1616,6 +1616,10 @@ static int kwbimage_verify_header(unsigned char *ptr, int image_size,
>  				  struct image_tool_params *params)
>  {
>  	uint8_t checksum;
> +	size_t header_size = kwbimage_header_size(ptr);
> +
> +	if (header_size > image_size)
> +		return -FDT_ERR_BADSTRUCTURE;
>  
>  	if (!main_hdr_checksum_ok(ptr))
>  		return -FDT_ERR_BADSTRUCTURE;
> 

Tested-by: Michal Simek <michal.simek@xilinx.com>

Thanks,
Michal
Stefan Roese March 20, 2018, 11:01 a.m. UTC | #2
On 15.03.2018 11:14, Alexander Graf wrote:
> The kwbimage format is reading beyond its header structure if it
> misdetects a Xilinx Zynq image and tries to read it. Fix it by
> sanity checking that the header we want to read fits inside our
> file size.
> 
> Signed-off-by: Alexander Graf <agraf@suse.de>
> ---
>   tools/kwbimage.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/tools/kwbimage.c b/tools/kwbimage.c
> index 3ca3b3b4a6..26686ad30f 100644
> --- a/tools/kwbimage.c
> +++ b/tools/kwbimage.c
> @@ -1616,6 +1616,10 @@ static int kwbimage_verify_header(unsigned char *ptr, int image_size,
>   				  struct image_tool_params *params)
>   {
>   	uint8_t checksum;
> +	size_t header_size = kwbimage_header_size(ptr);
> +
> +	if (header_size > image_size)
> +		return -FDT_ERR_BADSTRUCTURE;
>   
>   	if (!main_hdr_checksum_ok(ptr))
>   		return -FDT_ERR_BADSTRUCTURE;
> 

Reviewed-by: Stefan Roese <sr@denx.de>

Thanks,
Stefan
Stefan Roese March 30, 2018, 2:09 p.m. UTC | #3
On 15.03.2018 11:14, Alexander Graf wrote:
> The kwbimage format is reading beyond its header structure if it
> misdetects a Xilinx Zynq image and tries to read it. Fix it by
> sanity checking that the header we want to read fits inside our
> file size.
> 
> Signed-off-by: Alexander Graf <agraf@suse.de>
> ---
>   tools/kwbimage.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/tools/kwbimage.c b/tools/kwbimage.c
> index 3ca3b3b4a6..26686ad30f 100644
> --- a/tools/kwbimage.c
> +++ b/tools/kwbimage.c
> @@ -1616,6 +1616,10 @@ static int kwbimage_verify_header(unsigned char *ptr, int image_size,
>   				  struct image_tool_params *params)
>   {
>   	uint8_t checksum;
> +	size_t header_size = kwbimage_header_size(ptr);
> +
> +	if (header_size > image_size)
> +		return -FDT_ERR_BADSTRUCTURE;
>   
>   	if (!main_hdr_checksum_ok(ptr))
>   		return -FDT_ERR_BADSTRUCTURE;
> 

Applied to u-boot-marvell/master.

Thanks,
Stefan
diff mbox series

Patch

diff --git a/tools/kwbimage.c b/tools/kwbimage.c
index 3ca3b3b4a6..26686ad30f 100644
--- a/tools/kwbimage.c
+++ b/tools/kwbimage.c
@@ -1616,6 +1616,10 @@  static int kwbimage_verify_header(unsigned char *ptr, int image_size,
 				  struct image_tool_params *params)
 {
 	uint8_t checksum;
+	size_t header_size = kwbimage_header_size(ptr);
+
+	if (header_size > image_size)
+		return -FDT_ERR_BADSTRUCTURE;
 
 	if (!main_hdr_checksum_ok(ptr))
 		return -FDT_ERR_BADSTRUCTURE;