fit_import_data() reads each image's external data at the offset and size the FIT declares, without checking them against the file. An offset past the end of the file makes mkimage -F segfault, and a size running past it silently imports whatever memory follows. U-Boot proper and SPL already bound these properties since the series linked below; this series adds the same check to mkimage.
Patch 2 makes the data-offset, data-position and data-size accessors reject a property that is not exactly one cell, as was already done for data-size-unciphered. This also affects U-Boot proper and SPL, and adds 60 bytes to the pine64_plus SPL. Patch 4 switches fit_import_data() to these accessors and adds the bounds check. Patch 1 keeps an existing test meaningful once the check is in place, and patches 3 and 5 add the new tests. Link: https://lore.kernel.org/u-boot/[email protected]/ Link to v1: https://lore.kernel.org/r/[email protected] Changes in v2: - Patch 5: also cover a data-offset and data-size of two cells, which the import used to take from their first cell, rename the test to test_fit_import_data_prop_len and reword its comment and the commit message accordingly (Simon) - Patch 5: no longer claim that the hashing stage reports a skipped image (mkimage stops earlier, in the cipher pass), also in the comment of the existing test_fit_import_data_missing_offset() - Collected Simon's Reviewed-by on patches 1-4, which are unchanged - Rebased on current main The shared helper Simon suggested for the single-cell accessors will follow as a separate patch. Aristo Chen (5): test: py: keep the external payload when editing a FIT with fdtput image-fit: check the length of the external data properties test: boot: check the length of the external data properties tools: mkimage: bound external data reads in fit_import_data() test: py: cover invalid external data properties in fit_import_data() boot/image-fit.c | 21 ++++- test/boot/image.c | 44 +++++++++ test/py/tests/test_fit_import_data.py | 126 +++++++++++++++++++++++++- tools/fit_image.c | 41 ++++++--- 4 files changed, 213 insertions(+), 19 deletions(-) -- 2.43.0
