Three independent hardening fixes found by internal static analysis and code review. They do not depend on each other.
Changes in v2: - Dropped "boot: image-fit: add overflow guard for FIT decompression buffer" (2/4 in v1). As Tom pointed out, max_decomp_len is used both as the allocation size and as the unc_len bound handed to image_decomp(), so a wrapped multiply cannot leave the bound larger than the buffer, and image_decomp() already fails cleanly on a bound that is too small. The claim in that commit message was wrong, so the patch is withdrawn rather than reworded. - net: tftp: replaced the four bounded strncasecmp() comparisons with a single check that the packet ends in a NUL, per Tom's review. It is smaller (+16 bytes of .text on am335x_evm_defconfig instead of +24) and it also covers the dectoul() calls, which v1 left unbounded. Retitled to match. - Rebased onto current master (a44f46af0aa). - No change to the NFS and ext4 patches. Daniel Munic (1): fs: ext4: widen ext4fs_update() block-group loop counter Drew Kluemke (2): net: nfs: add bounds checks on memcpy into stack-allocated rpc_pkt net: tftp: verify the OACK packet is NUL terminated fs/ext4/ext4_write.c | 2 +- net/nfs-common.c | 10 ++++++++++ net/tftp.c | 7 +++++++ 3 files changed, 18 insertions(+), 1 deletion(-) -- 2.49.0
