On Mon, Aug 10, 2026 at 11:09:56PM +0100, Anton Ivanov via U-Boot wrote: > The data-offset, data-position and data-size FIT properties are > excluded from the configuration signature, so they are attacker > controlled even when signature verification succeeds. The offset and > size arithmetic in load_simple_fit() can wrap on hostile values: > > - adding the external-data base offset to data-offset can wrap past > UINT32_MAX, > - get_aligned_image_size() adds the block-alignment overhead and > rounds up to the block length, which can wrap past ULONG_MAX, > - adding the FIT's device offset to the aligned external-data offset > can wrap past ULONG_MAX. > > Make get_aligned_image_size() return the aligned size through an out > parameter and fail with -EOVERFLOW when the computation would wrap, > check the two offset additions explicitly, and compare the > block-aligned size (the amount info->read() actually transfers) > against max_size before reading. Do the same for the FIT header read > in spl_simple_fit_read(). > > Signed-off-by: Anton Ivanov <[email protected]>
Unfortunately this leads to a large size increase in SPL on am335x_evm (and related build variants) and it overflows the allowed size. -- Tom
signature.asc
Description: PGP signature
