On 2026-08-15T22:07:52, Pranav Rajendran <[email protected]> wrote: > lib: aes: reject a ciphertext length that is not a whole number of blocks > > image_aes_decrypt() allocates cipher_len bytes for the plaintext but > then asks aes_cbc_decrypt_blocks() to write > DIV_ROUND_UP(cipher_len, AES_BLOCK_LENGTH) blocks into it. For a > cipher_len that is not a multiple of AES_BLOCK_LENGTH the rounding up > adds one block, so the last block is written up to AES_BLOCK_LENGTH - 1 > bytes past the end of the allocation, and read the same distance past > the end of the ciphertext. > > cipher_len is the size of the image data in the FIT, so an image with a > 'data' property whose length is not block aligned is enough to reach > this. The overflowing bytes are decryption output, i.e. they depend on > the key, but the length itself is not covered by anything that would > stop the image from being parsed this far. > > A CBC ciphertext is a whole number of blocks by construction, so treat > anything else as a malformed image and reject it before allocating. > With that established, compute the block count with a plain division so > the buffer size and the write length cannot drift apart again. > > Fixes: 4df3578119b0 ("u-boot: fit: add support to decrypt fit with aes") > Signed-off-by: Pranav Rajendran <[email protected]> > > lib/aes/aes-decrypt.c | 12 +++++++++++- > 1 file changed, 11 insertions(+), 1 deletion(-)
Reviewed-by: Simon Glass <[email protected]>
