[U-Boot] [PATCH] kwbimage: Fix out of bounds access

[Stefan Roese]

On 15.03.2018 11:14, Alexander Graf wrote:
> The kwbimage format is reading beyond its header structure if it
> misdetects a Xilinx Zynq image and tries to read it. Fix it by
> sanity checking that the header we want to read fits inside our
> file size.
> 
> Signed-off-by: Alexander Graf <agraf at suse.de>
> ---
>   tools/kwbimage.c | 4 ++++
>   1 file changed, 4 insertions(+)
> 
> diff --git a/tools/kwbimage.c b/tools/kwbimage.c
> index 3ca3b3b4a6..26686ad30f 100644
> --- a/tools/kwbimage.c
> +++ b/tools/kwbimage.c
> @@ -1616,6 +1616,10 @@ static int kwbimage_verify_header(unsigned char *ptr, int image_size,
>   				  struct image_tool_params *params)
>   {
>   	uint8_t checksum;
> +	size_t header_size = kwbimage_header_size(ptr);
> +
> +	if (header_size > image_size)
> +		return -FDT_ERR_BADSTRUCTURE;
>   
>   	if (!main_hdr_checksum_ok(ptr))
>   		return -FDT_ERR_BADSTRUCTURE;
> 

Reviewed-by: Stefan Roese <sr at denx.de>

Thanks,
Stefan