On 2026-08-10T22:09:53, Anton Ivanov <[email protected]> wrote: > spl: fit: Harden external-data offset and size arithmetic > > The data-offset, data-position and data-size FIT properties are > excluded from the configuration signature, so they are attacker > controlled even when signature verification succeeds. The offset and > size arithmetic in load_simple_fit() can wrap on hostile values: > > - adding the external-data base offset to data-offset can wrap past > UINT32_MAX, > - get_aligned_image_size() adds the block-alignment overhead and > rounds up to the block length, which can wrap past ULONG_MAX, > - adding the FIT's device offset to the aligned external-data offset > can wrap past ULONG_MAX. > > Make get_aligned_image_size() return the aligned size through an out > parameter and fail with -EOVERFLOW when the computation would wrap, > check the two offset additions explicitly, and compare the > block-aligned size (the amount info->read() actually transfers) > against max_size before reading. Do the same for the FIT header read > in spl_simple_fit_read(). > > Signed-off-by: Anton Ivanov <[email protected]> > > common/spl/spl_fit.c | 98 +++++++++++++++++++++++++++++---------------------- > test/image/spl_load.c | 57 ++++++++++++++++++++++++++++++ > 2 files changed, 112 insertions(+), 43 deletions(-)
Reviewed-by: Simon Glass <[email protected]>
