[PATCH v2 3/3] test: vbe: cover vbe_read_fit() external-data bounds checks

[Simon Glass]

Hi Aristo,

On 2026-07-02T07:13:56, Aristo Chen <aristo.chen at canonical.com> wrote:
> test: vbe: cover vbe_read_fit() external-data bounds checks
>
> vbe_read_fit() rejects FITs whose external-data window extends past the
> trusted firmware area on disk by returning -E2BIG. Add two sandbox unit
> tests that construct synthetic FITs with attacker-controlled
> data-position and data-size values, write them to mmc1, and assert
> vbe_read_fit() catches each one before issuing the follow-up
> blk_read().
>
> vbe_read_fit_oob_position uses a data-position past area_size, which
> trips the load_addr - addr > area_size clause. vbe_read_fit_oversize_data
> keeps data-position inside the area but picks a data-size that overruns
> area_size - (load_addr - addr), tripping the third clause.
>
> The new file follows the existing bootstd VBE test layout and writes
> the FIT at block 16, past the version and nvdata blocks already used by
> bootstd_setup_for_tests().
>
> Suggested-by: Simon Glass <sjg at chromium.org>
> Signed-off-by: Aristo Chen <aristo.chen at canonical.com>
>
> test/boot/Makefile       |   2 +-
>  test/boot/vbe_read_fit.c | 225 +++++++++++++++++++++++++++++++++++++++++++++++
>  2 files changed, 226 insertions(+), 1 deletion(-)

Thanks for doing the test!

> diff --git a/test/boot/vbe_read_fit.c b/test/boot/vbe_read_fit.c
> @@ -0,0 +1,225 @@
> +#include <blk.h>
> +#include <dm.h>
> +#include <image.h>
> +#include <mapmem.h>
> +#include <memalign.h>
> +#include <mmc.h>

Nothing here uses map_sysmem() or friends, so <mapmem.h> can go.

> diff --git a/test/boot/vbe_read_fit.c b/test/boot/vbe_read_fit.c
> @@ -0,0 +1,225 @@
> +/*
> + * The synthetic FIT is written to mmc1 starting at block TEST_FIT_BLK.
> + * bootstd_setup_for_tests() uses blocks 4 and 6 (see bootstd_common.h);
> + * block 16 leaves a comfortable gap.
> + */
> +#define TEST_FIT_BLK 16

Just to check, the two clauses that stay unreachable in sandbox
(load_addr < addr while TEXT_BASE is 0, and the FDT bound behind
!CONFIG_SANDBOX in vbe_read_fit()) - is that why only data-position
and data-size are exercised? A one-line note in the commit message
would help future readers.

Reviewed-by: Simon Glass <sjg at chromium.org>

Regards,
Simon