Hi Aristo, On 2026-07-02T07:13:56, Aristo Chen <[email protected]> wrote: > test: vbe: cover vbe_read_fit() external-data bounds checks > > vbe_read_fit() rejects FITs whose external-data window extends past the > trusted firmware area on disk by returning -E2BIG. Add two sandbox unit > tests that construct synthetic FITs with attacker-controlled > data-position and data-size values, write them to mmc1, and assert > vbe_read_fit() catches each one before issuing the follow-up > blk_read(). > > vbe_read_fit_oob_position uses a data-position past area_size, which > trips the load_addr - addr > area_size clause. vbe_read_fit_oversize_data > keeps data-position inside the area but picks a data-size that overruns > area_size - (load_addr - addr), tripping the third clause. > > The new file follows the existing bootstd VBE test layout and writes > the FIT at block 16, past the version and nvdata blocks already used by > bootstd_setup_for_tests(). > > Suggested-by: Simon Glass <[email protected]> > Signed-off-by: Aristo Chen <[email protected]> > > test/boot/Makefile | 2 +- > test/boot/vbe_read_fit.c | 225 > +++++++++++++++++++++++++++++++++++++++++++++++ > 2 files changed, 226 insertions(+), 1 deletion(-)
Thanks for doing the test! > diff --git a/test/boot/vbe_read_fit.c b/test/boot/vbe_read_fit.c > @@ -0,0 +1,225 @@ > +#include <blk.h> > +#include <dm.h> > +#include <image.h> > +#include <mapmem.h> > +#include <memalign.h> > +#include <mmc.h> Nothing here uses map_sysmem() or friends, so <mapmem.h> can go. > diff --git a/test/boot/vbe_read_fit.c b/test/boot/vbe_read_fit.c > @@ -0,0 +1,225 @@ > +/* > + * The synthetic FIT is written to mmc1 starting at block TEST_FIT_BLK. > + * bootstd_setup_for_tests() uses blocks 4 and 6 (see bootstd_common.h); > + * block 16 leaves a comfortable gap. > + */ > +#define TEST_FIT_BLK 16 Just to check, the two clauses that stay unreachable in sandbox (load_addr < addr while TEXT_BASE is 0, and the FDT bound behind !CONFIG_SANDBOX in vbe_read_fit()) - is that why only data-position and data-size are exercised? A one-line note in the commit message would help future readers. Reviewed-by: Simon Glass <[email protected]> Regards, Simon
