From 6cd5678c45e7b684e7af88c256cdacd03a76fb1c Mon Sep 17 00:00:00 2001
From: Alexander Graf <agraf@suse.de>
Date: Thu, 15 Mar 2018 11:14:19 +0100
Subject: [PATCH] kwbimage: Fix out of bounds access
The kwbimage format is reading beyond its header structure if it
misdetects a Xilinx Zynq image and tries to read it. Fix it by
sanity checking that the header we want to read fits inside our
file size.
Signed-off-by: Alexander Graf <agraf@suse.de>
Tested-by: Michal Simek <michal.simek@xilinx.com>
Reviewed-by: Stefan Roese <sr@denx.de>
Signed-off-by: Stefan Roese <sr@denx.de>
---
tools/kwbimage.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/tools/kwbimage.c b/tools/kwbimage.c
index 3ca3b3b4a62..26686ad30f9 100644
--- a/tools/kwbimage.c
+++ b/tools/kwbimage.c
@@ -1616,6 +1616,10 @@ static int kwbimage_verify_header(unsigned char *ptr, int image_size,
struct image_tool_params *params)
{
uint8_t checksum;
+ size_t header_size = kwbimage_header_size(ptr);
+
+ if (header_size > image_size)
+ return -FDT_ERR_BADSTRUCTURE;
if (!main_hdr_checksum_ok(ptr))
return -FDT_ERR_BADSTRUCTURE;
--
GitLab