On 2026-08-15T22:07:52, Pranav Rajendran <[email protected]> wrote: > lib: aes: reject an unciphered size larger than the ciphertext > > image_aes_decrypt() allocates cipher_len bytes, decrypts into them, and > then reports the plaintext length to its caller as > info->size_unciphered, without relating the two. size_unciphered comes > from the image's 'data-size-unciphered' property, so an image can claim > a plaintext larger than the buffer that was allocated for it. > > fit_image_uncipher() propagates that length as the image size, and > everything downstream - the load, the copy to the entry point - works > from it, reading up to 4 GiB past the end of the decrypted buffer. > > Unlike the image data itself, 'data-size-unciphered' is not covered by > the per-image hash or signature, so this is reachable on a signed FIT > whose signature still verifies. > > Decryption produces exactly cipher_len bytes, so require the claimed > size to fit within that. > > Fixes: 4df3578119b0 ("u-boot: fit: add support to decrypt fit with aes") > Signed-off-by: Pranav Rajendran <[email protected]> > > lib/aes/aes-decrypt.c | 9 +++++++++ > 1 file changed, 9 insertions(+)
Reviewed-by: Simon Glass <[email protected]>
