Skip to contentSkip to conversation

kwbimage: Fix out of bounds access

PATCH New Alexander Graf 3 participants 4 messages Mar 15, 2018 – Mar 30, 2018

lore
Share & tools
lore

Alexander Graf

author
#0 lore raw

PATCH 1/1 kwbimage: Fix out of bounds access

The kwbimage format is reading beyond its header structure if it misdetects a Xilinx Zynq image and tries to read it. Fix it by sanity checking that the header we want to read fits inside our file size.

Signed-off-by Alexander Graf <[email protected]>
---
 tools/kwbimage.c | 4 ++++
 1 file changed, 4 insertions(+)
tools/kwbimage.c +4 -0
index 3ca3b3b4a6..26686ad30f 100644
@@ -1616,6 +1616,10 @@ static int kwbimage_verify_header(unsigned char *ptr, int image_size,
 				  struct image_tool_params *params)
 {
 	uint8_t checksum;
+	size_t header_size = kwbimage_header_size(ptr);
+
+	if (header_size > image_size)
+		return -FDT_ERR_BADSTRUCTURE;
 
 	if (!main_hdr_checksum_ok(ptr))
 		return -FDT_ERR_BADSTRUCTURE;
Signature · 1 line
2.12.3
#1 lore raw

PATCH 1/1 kwbimage: Fix out of bounds access

Quoted 16 lines · Alexander Graf

The kwbimage format is reading beyond its header structure if it misdetects a Xilinx Zynq image and tries to read it. Fix it by sanity checking that the header we want to read fits inside our file size.

Signed-off-by Alexander Graf <[email protected]>
---
 tools/kwbimage.c | 4 ++++
 1 file changed, 4 insertions(+)
tools/kwbimage.c +0 -0
index 3ca3b3b4a6..26686ad30f 100644

tools/kwbimage.c static int kwbimage_verify_header(unsigned char *ptr, int image_size, · line 1625

Quoted 10 lines
tools/kwbimage.c +4 -0
@@ -1616,6 +1616,10 @@ static int kwbimage_verify_header(unsigned char *ptr, int image_size,
 				  struct image_tool_params *params)
 {
 	uint8_t checksum;
+	size_t header_size = kwbimage_header_size(ptr);
+
+	if (header_size > image_size)
+		return -FDT_ERR_BADSTRUCTURE;
 
 	if (!main_hdr_checksum_ok(ptr))
 		return -FDT_ERR_BADSTRUCTURE;
Tested-by Michal Simek <[email protected]>

Thanks,
Michal

#2 lore raw

PATCH 1/1 kwbimage: Fix out of bounds access

In reply to Alexander Graf
Quoted 16 lines · Alexander Graf

The kwbimage format is reading beyond its header structure if it misdetects a Xilinx Zynq image and tries to read it. Fix it by sanity checking that the header we want to read fits inside our file size.

Signed-off-by Alexander Graf <[email protected]>
---
  tools/kwbimage.c | 4 ++++
  1 file changed, 4 insertions(+)
tools/kwbimage.c +0 -0
index 3ca3b3b4a6..26686ad30f 100644

tools/kwbimage.c static int kwbimage_verify_header(unsigned char *ptr, int image_size, · line 1625

Quoted 10 lines
tools/kwbimage.c +4 -0
@@ -1616,6 +1616,10 @@ static int kwbimage_verify_header(unsigned char *ptr, int image_size,
  				  struct image_tool_params *params)
  {
  	uint8_t checksum;
+	size_t header_size = kwbimage_header_size(ptr);
+
+	if (header_size > image_size)
+		return -FDT_ERR_BADSTRUCTURE;
 
  	if (!main_hdr_checksum_ok(ptr))
  		return -FDT_ERR_BADSTRUCTURE;
Reviewed-by Stefan Roese <[email protected]>

Thanks,
Stefan

#3 lore raw

PATCH 1/1 kwbimage: Fix out of bounds access

In reply to Alexander Graf
Quoted 16 lines · Alexander Graf

The kwbimage format is reading beyond its header structure if it misdetects a Xilinx Zynq image and tries to read it. Fix it by sanity checking that the header we want to read fits inside our file size.

Signed-off-by Alexander Graf <[email protected]>
---
  tools/kwbimage.c | 4 ++++
  1 file changed, 4 insertions(+)
tools/kwbimage.c +0 -0
index 3ca3b3b4a6..26686ad30f 100644

tools/kwbimage.c static int kwbimage_verify_header(unsigned char *ptr, int image_size, · line 1625

Quoted 10 lines
tools/kwbimage.c +4 -0
@@ -1616,6 +1616,10 @@ static int kwbimage_verify_header(unsigned char *ptr, int image_size,
  				  struct image_tool_params *params)
  {
  	uint8_t checksum;
+	size_t header_size = kwbimage_header_size(ptr);
+
+	if (header_size > image_size)
+		return -FDT_ERR_BADSTRUCTURE;
 
  	if (!main_hdr_checksum_ok(ptr))
  		return -FDT_ERR_BADSTRUCTURE;

Applied to u-boot-marvell/master.

Thanks,
Stefan