On 2026-07-08T10:34:47, Aristo Chen <[email protected]> wrote: > spl: fit: bound the external data size before reading it > > load_simple_fit() loads an image stored as external data by reading > it from the boot device with a transfer sized from the FIT data-size > property. That property is listed in exc_prop[] in image-fit-sig.c, > so it is excluded from the configuration signature and stays under > the control of anyone able to modify the boot medium even when > CONFIG_SPL_FIT_SIGNATURE is enabled. The read happens before > fit_image_verify_with_data() checks the image hash, so an inflated > data-size overruns the destination before the corruption can be > detected. The device-tree overlay path is the sharpest case, because > there the destination is a fixed CONFIG_SPL_LOAD_FIT_APPLY_OVERLAY_BUF_SZ > heap buffer. > > Pass the size of the destination into load_simple_fit() and reject > an image whose data does not fit before the read is issued. The > check is done in two places: an early bail on len > max_size, then a > bail on the block-aligned size > max_size. The size check is the > mathematically binding one because size is len rounded up to the > device block length. The early bail exists so that > get_aligned_image_size() never runs on a hostile len, where its int > arithmetic would invoke signed-integer overflow. > > For the overlay path the bound is exact: the caller passes the size > of its temporary buffer. For the firmware, loadables, FDT and FPGA > call sites the destination is wherever the load_addr field points, > with no defined upper limit at the call site. Those callers pass > CONFIG_SYS_BOOTM_LEN as a conservative ceiling, matching the same > limit spl_parse_legacy_validate() already applies to legacy images. > It is not a tight bound on the actual capacity at the destination, > just a cap that rejects implausibly-sized data. > > Signed-off-by: Aristo Chen <[email protected]> > > common/spl/spl_fit.c | 51 +++++++++++++++++++++++++++++++++++++++++++++------ > 1 file changed, 45 insertions(+), 6 deletions(-)
Reviewed-by: Simon Glass <[email protected]>
