On 2026-07-30T15:03:40, Anton Ivanov <[email protected]> wrote: > spl: fit: Bound external data like U-Boot proper > > fit_image_get_data() checks that the external-data region fits in the > addressable range and, for signed FITs, stays below > FIT_SIGNATURE_MAX_SIZE. The SPL loader had no equivalent check, so a > hostile data-offset or data-size could make the read offset wrap past > ULONG_MAX, or the destination range wrap around the end of the address > space. > > Add the same check to load_simple_fit(), using the block-aligned read > size and the source pointer the read actually uses. > > Signed-off-by: Anton Ivanov <[email protected]> > > common/spl/spl_fit.c | 26 ++++++++++++++++++++++++++ > test/image/spl_load.c | 23 +++++++++++++++++++++++ > 2 files changed, 49 insertions(+)
Reviewed-by: Simon Glass <[email protected]>
