On Tue, Jun 02, 2026 at 07:29:25PM +0100, Anton Ivanov wrote: > fit_config_check_sig() reads the hashed-strings property and uses > its size value without validation when building the region list for > signature verification. A crafted FIT image can specify an arbitrary > size, causing the hash calculation to read beyond the end of the FIT > image. The property length is also not checked, so a truncated > hashed-strings property causes strings[1] to be read past the end of > the property. This may result in the out-of-bounds read during signature > verification of an untrusted FIT. > > Validate both the property length and that the declared strings region > fits within bounds before adding it to the region list. > > Signed-off-by: Anton Ivanov <[email protected]>
Applied to u-boot/next, thanks! -- Tom
signature.asc
Description: PGP signature
