From: Drew Kluemke <[email protected]> Add an overflow check before the 'len * 20' multiplication used to compute the maximum decompression buffer size. On platforms where len exceeds ULONG_MAX / 20 the multiplication wraps to a small value, leading malloc to allocate a tiny buffer while decompression writes the full stream -- a heap buffer overflow.
Guard against this by returning -ENOEXEC when len exceeds the safe threshold. Signed-off-by: Drew Kluemke <[email protected]> Signed-off-by: Sriram Sriram <[email protected]> --- boot/image-fit.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/boot/image-fit.c b/boot/image-fit.c index 26e9323da06..9770435f939 100644 --- a/boot/image-fit.c +++ b/boot/image-fit.c @@ -2355,9 +2355,17 @@ int fit_image_load(struct bootm_headers *images, ulong addr, !(image_type == IH_TYPE_KERNEL || image_type == IH_TYPE_KERNEL_NOLOAD || image_type == IH_TYPE_RAMDISK)) { - ulong max_decomp_len = len * 20; + ulong max_decomp_len; log_debug("decompressing image\n"); + + if (len > ULONG_MAX / 20) { + printf("Error: %s image too large for decompression (0x%lx)\n", + prop_name, len); + return -ENOEXEC; + } + max_decomp_len = len * 20; + if (load == data) { loadbuf = aligned_alloc(8, max_decomp_len); load = map_to_sysmem(loadbuf); -- 2.49.0
