Hi He Yong, On 2026-10-13T13:02:35, He Yong <[email protected]> wrote:
> This series adds a bootmeth for U-Boot script images stored directly in a > named partition, without a filesystem. It first adds bounds checks to the > shared legacy script parser, so the existing script bootmeth and source > command benefit from the same protection. This is true for legacy images, but the FIT checks (fdt_check_full() against the known size, and rejecting external data) are only in the new raw bootmeth, in script_raw_validate(). The existing script bootmeth also knows the size of the file it has read, so a FIT script with a bad structure, or with external-data offsets pointing past the end of the buffer, is still a problem there. Please can you move the FIT checks into image_locate_script() for the case where the size is known, as patch 1 does for legacy images? Then the raw bootmeth only has to work out the size and read the image, and both methods get the same protection. > Changes since v1: > - Split the shared legacy parser bounds checks into patch 1. Patch 2 still does several separate things: it exports script_boot() as bootmeth_script_boot(), adds the new bootmeth with its Kconfig and docs, and enables it for sandbox along with the test.dts node, the image generator, the new tests and the changes to existing tests. It would be worth splitting it into a small preparatory patch to export script_boot(), then the bootmeth and docs, then a final patch that enables it on sandbox and adds the tests. The changes to the existing bootflow/bootmeth tests need to stay in that final patch with the defconfig and test.dts changes, so each commit still passes the tests. BTW, 'test/py/img/' is a new directory in mainline. At present the image setup for the C tests lives in 'test_ut.py', so please can mention this in the commit message. Regards, Simon
