[U-Boot,1/2] image-sig: Ensure that hashed-nodes is null-terminated

Message ID 1541620306-14314-1-git-send-email-trini@konsulko.com
State Under Review
Delegated to: Tom Rini
Headers show
Series
  • [U-Boot,1/2] image-sig: Ensure that hashed-nodes is null-terminated
Related show

Commit Message

Tom Rini Nov. 7, 2018, 7:51 p.m.
From: Konrad Beckmann <konrad.beckmann@gmail.com>

A specially crafted FIT image leads to memory corruption in the stack
when using the verified boot feature. The function fit_config_check_sig
has a logic error that makes it possible to write past the end of the
stack allocated array node_inc. This could potentially be used to bypass
the signature check when using verified boot.

This change ensures that the number of strings is correct when counted.

Signed-off-by: Konrad Beckmann <konrad.beckmann@gmail.com>
---
 common/image-sig.c | 5 +++++
 1 file changed, 5 insertions(+)

Comments

Simon Glass Nov. 13, 2018, 7:54 p.m. | #1
On 7 November 2018 at 11:51, Tom Rini <trini@konsulko.com> wrote:
> From: Konrad Beckmann <konrad.beckmann@gmail.com>
>
> A specially crafted FIT image leads to memory corruption in the stack
> when using the verified boot feature. The function fit_config_check_sig
> has a logic error that makes it possible to write past the end of the
> stack allocated array node_inc. This could potentially be used to bypass
> the signature check when using verified boot.
>
> This change ensures that the number of strings is correct when counted.
>
> Signed-off-by: Konrad Beckmann <konrad.beckmann@gmail.com>
> ---
>  common/image-sig.c | 5 +++++
>  1 file changed, 5 insertions(+)

Reviewed-by: Simon Glass <sjg@chromium.org>

Patch

diff --git a/common/image-sig.c b/common/image-sig.c
index 5a269d3289bf..5d860e126637 100644
--- a/common/image-sig.c
+++ b/common/image-sig.c
@@ -334,6 +334,11 @@  int fit_config_check_sig(const void *fit, int noffset, int required_keynode,
 		return -1;
 	}
 
+	if (prop && prop_len > 0 && prop[prop_len - 1] != '\0') {
+		*err_msgp = "hashed-nodes property must be null-terminated";
+		return -1;
+	}
+
 	/* Add a sanity check here since we are using the stack */
 	if (count > IMAGE_MAX_HASHED_NODES) {
 		*err_msgp = "Number of hashed nodes exceeds maximum";