fit_import_data() reads each image's external data at the offset and size the FIT declares, without checking them against the file. An offset past the end of the file makes mkimage -F segfault, and a size running past it silently imports whatever memory follows. U-Boot proper and SPL already bound these properties since the series linked below; this series adds the same check to mkimage.
Patch 2 makes the data-offset, data-position and data-size accessors reject a property that is not exactly one cell, as was already done for data-size-unciphered. This also affects U-Boot proper and SPL, and adds 60 bytes to the pine64_plus SPL. Patch 4 switches fit_import_data() to these accessors and adds the bounds check. Patch 1 keeps an existing test meaningful once the check is in place, and patches 3 and 5 add the new tests. Link: https://lore.kernel.org/u-boot/[email protected]/ Aristo Chen (5): test: py: keep the external payload when editing a FIT with fdtput image-fit: check the length of the external data properties test: boot: check the length of the external data properties tools: mkimage: bound external data reads in fit_import_data() test: py: cover invalid external data properties in fit_import_data() boot/image-fit.c | 21 ++++- test/boot/image.c | 44 ++++++++++ test/py/tests/test_fit_import_data.py | 121 +++++++++++++++++++++++++- tools/fit_image.c | 41 ++++++--- 4 files changed, 209 insertions(+), 18 deletions(-) -- 2.43.0
