On 2026-10-11T15:21:13, Aristo Chen <[email protected]> wrote: > tools: mkimage: bound external data reads in fit_import_data() > > fit_import_data() reads each image's external data from the mapped FIT > file at the offset and size the FIT itself declares, without checking > that the region lies inside the file. A data-offset or data-position > pointing past the end of the file, or a size reaching beyond it, makes > mkimage read outside the mapping, crashing on re-process or silently > importing unrelated memory as image data. An authored .its that > declares external data properties hits the same path, since dtc > produces no payload beyond the device tree. > > Read the properties through fit_image_get_data_position(), > fit_image_get_data_offset() and fit_image_get_data_size(), which return > u32 since commit c4d81d062790 ("image-fit: Use unsigned types for > external data properties"), so a value of 0xffffffff is no longer > mistaken for a missing property. They fail for a property that is not > exactly one cell, and the import then skips the image as if the > property were missing, as it already did for a shorter one. Compute the > file offset in 64 bits and require the whole region to lie within the > mapped file before importing it, with an error naming the image and the > offending values. An empty region reads nothing, so it is not checked: > mkimage -E -p places one past the end of the file when every image is > empty, and such a FIT must still re-process. > > Signed-off-by: Aristo Chen <[email protected]> > > tools/fit_image.c | 41 +++++++++++++++++++++++++++++------------ > 1 file changed, 29 insertions(+), 12 deletions(-)
Reviewed-by: Simon Glass <[email protected]>
