From patchwork Mon Dec 4 10:05:34 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Glembotzki X-Patchwork-Id: 1871475 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@legolas.ozlabs.org Authentication-Results: legolas.ozlabs.org; dkim=pass (2048-bit key; unprotected) header.d=googlegroups.com header.i=@googlegroups.com header.a=rsa-sha256 header.s=20230601 header.b=csn/cq4t; dkim=pass (2048-bit key; unprotected) header.d=gmail.com header.i=@gmail.com header.a=rsa-sha256 header.s=20230601 header.b=StF++hTN; dkim-atps=neutral Authentication-Results: legolas.ozlabs.org; spf=pass (sender SPF authorized) smtp.mailfrom=googlegroups.com (client-ip=2a00:1450:4864:20::43e; helo=mail-wr1-x43e.google.com; envelope-from=swupdate+bncbdy5juxlviebbjojw2vqmgqet25ztnq@googlegroups.com; receiver=patchwork.ozlabs.org) Received: from mail-wr1-x43e.google.com (mail-wr1-x43e.google.com [IPv6:2a00:1450:4864:20::43e]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (secp384r1) server-digest SHA384) (No client certificate requested) by legolas.ozlabs.org (Postfix) with ESMTPS id 4SkK7v5Tcrz23nk for ; Mon, 4 Dec 2023 21:06:34 +1100 (AEDT) Received: by mail-wr1-x43e.google.com with SMTP id ffacd0b85a97d-332e71b8841sf3357058f8f.0 for ; Mon, 04 Dec 2023 02:06:34 -0800 (PST) ARC-Seal: i=2; a=rsa-sha256; t=1701684390; cv=pass; d=google.com; s=arc-20160816; b=XZrkU2r7E5DHUQiSVn4XlHKNBch0lzYb2oy0YQVfHbH6OeQuZJs0xCPEfmwgGBcSvY E0K90DLMPsA7NIbCSnc6bT6Wd9s7D7dL67T1Z8fgcQjdk0zx0SUNbthRzK6sS82yIQ4z /JNtjTrAtDwjQiysjmtEml71Bv+OcZtDNpm8wmiR5M5P0cpqTmu34gWUlitcsdY4PHql 7UPIqybXfeA8e3wLhWTHtFDiwgPA8lxKaIHfIj14kFVW9dw5WToTwNfsPWzEcojEzbLw iaJ4h9dM1XtjGWqKiyuuLMR5aFBlEJErtD0QrsqUBPIJWpPe+TIkY47r+GllaJXpMPck GfWA== ARC-Message-Signature: i=2; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:sender:dkim-signature :dkim-signature; bh=O2+lQWYOy+syo6AcJEK5NZeMjKyfpTCtl0Ys/MmLeR8=; fh=zydHuzCQWrku2OPQyZfraJZFcOpEXLQ/YBcu3QNiBd0=; b=wjdp9KdIy0cR4QSLX4clYjeZ4NxZM8h5aou9z3+wpA/7OysZAPInUbZ/qZ5pO10Apf XHHSThwnI9ZVSFS9NrybivNB35z5ToVkxckkcFGNZDCgLlNFN5PZDCOEOmJv9NLVhDz2 5VujS0HHhVk4w37i05jsCy3wT2/mslBhEmWKrCoGUFWILECVlj82iIprkurUGn3IzM+w JDy1PCc1cwlOi6OvJ7/29e/4I1ueTAEFnWvMaDDGQbqj+Xm7NjiAay8JBDrRExt5wUtS Jvf7V5j5DnkQ+Dzc+wJGngt6rDMSkwoMPF7wiKl1SeiEDlPQJcsdDzaB++2BXlN1Xnhv r20g== ARC-Authentication-Results: i=2; gmr-mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=CxJkJ0oY; spf=pass (google.com: domain of m.glembo@gmail.com designates 2a00:1450:4864:20::62b as permitted sender) smtp.mailfrom=m.glembo@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=googlegroups.com; s=20230601; t=1701684390; x=1702289190; darn=patchwork.ozlabs.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:mime-version:references:in-reply-to:message-id :date:subject:cc:to:from:sender:from:to:cc:subject:date:message-id :reply-to; bh=O2+lQWYOy+syo6AcJEK5NZeMjKyfpTCtl0Ys/MmLeR8=; b=csn/cq4tK4/K0scTY6xp/WcnaGd3wa+Qjtug6Mm2ETCCok+pl2elG4w5nE+heoBhmK 22IpEib6rinEpjesr/QkaehvmJE4rClrlHYW3MlPxzsysfFpLTI0CFp/RIlrArXxsGxh OJpR3bfoNzXtnokRcnWQYhz0FRM65m5Zx1IZTDkXHhpCEy8NM0qn/S1hz3zPUK2GapbE eiqL3Kqq5QHkO3CQW22FrQ2IByH0N3VlchccfhCDHZ6BV+mOUvyUGI9cjIByvlacRkNY fsraks0mxmKsm5zdQJKnNhX0Te3HN6SoCkDV+qUCgXehjXOOS7GUT4/NtWX8xcU0hDD1 Og8Q== DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1701684390; x=1702289190; darn=patchwork.ozlabs.org; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :list-id:mailing-list:precedence:x-original-authentication-results :x-original-sender:mime-version:references:in-reply-to:message-id :date:subject:cc:to:from:from:to:cc:subject:date:message-id:reply-to; bh=O2+lQWYOy+syo6AcJEK5NZeMjKyfpTCtl0Ys/MmLeR8=; b=StF++hTNUHh8QLD9WTFZ+bCZ5qh728uW2YXYmzOyixNF5UOYURtbcuJkiD0qgEYFdW aeYcsZTHElWoHgilQoI5edqUus3PQUhOHfGmDf3fGVCArYlHMx4kqFDoykj0iPWYpgXc VgjOxF2HiDz7QOvGJuotMQIEqKn6/dRt3MxidH2hN6Uv/LOASuZ4T3hKrmGlYJQlvkcf xoKGSdt+wS3/lx6iYG6eja/W7H7If0oSDmVs16lOJPjz3sylH90HXYepQeWZEePH/5q1 AoXHzlOAjUlfRfPA1D5PA1vB0Xj+6Hs57+KKSdH56Z3XHhTPS2LjZMGnCL1eRRugS27E 0EZA== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1701684390; x=1702289190; h=list-unsubscribe:list-subscribe:list-archive:list-help:list-post :x-spam-checked-in-group:list-id:mailing-list:precedence :x-original-authentication-results:x-original-sender:mime-version :references:in-reply-to:message-id:date:subject:cc:to:from :x-beenthere:x-gm-message-state:sender:from:to:cc:subject:date :message-id:reply-to; bh=O2+lQWYOy+syo6AcJEK5NZeMjKyfpTCtl0Ys/MmLeR8=; b=xAZjtBwRJ1YsRHQi6Z+V8E+QyQg55mwWEvc0/3p21r/drcE4DxrrQP1SCRfhV+87PJ S9c3f285BktIrZWUeKDLg6zesMbbacK9v+7REFiMXuz3PtbuhOVGzHJ4goCKhhUutkad +STqdWIohR33dsR98dQRrXj85vabgQb9JAS40CXC1lRf3kQFKwrxOz97T+QmciuBJ17A LKc1DQSRwvCv36RreI38RQ5Ozfs6AXA1gNWEz9x+Trvf7q1PVmOU5qoS5q/ufbHJgl/C /Mloj1Jce0cTlnciBpBEwKaDLoyko4Zl/zb34WtGWoO7VR0e/QhX2EAt5EfS45H2OTfs kBDw== Sender: swupdate@googlegroups.com X-Gm-Message-State: AOJu0YzY4C6fHolKzWR3ka/B4ozk6ZvoAbU36rxvSzwYD4nMOI2b6vwi FWH5KCKwu40lNbvf4Ay3V4Y= X-Google-Smtp-Source: AGHT+IGG3JXLjst/jZNjtBGf91rFU0eVnElSHADNXdGsG3mel3Gx9h6YxWivZB/SmFyMOhrvmuQqnA== X-Received: by 2002:a5d:54c7:0:b0:333:1fbd:8ecd with SMTP id x7-20020a5d54c7000000b003331fbd8ecdmr3467182wrv.52.1701684389701; Mon, 04 Dec 2023 02:06:29 -0800 (PST) X-BeenThere: swupdate@googlegroups.com Received: by 2002:a5d:4092:0:b0:333:51df:53ca with SMTP id o18-20020a5d4092000000b0033351df53cals171950wrp.1.-pod-prod-05-eu; Mon, 04 Dec 2023 02:06:27 -0800 (PST) X-Received: by 2002:adf:faca:0:b0:333:3518:c6a5 with SMTP id a10-20020adffaca000000b003333518c6a5mr2372084wrs.40.1701684387485; Mon, 04 Dec 2023 02:06:27 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1701684387; cv=none; d=google.com; s=arc-20160816; b=X1zgFIff6lz9uNif3ZSQotdE9tI0sOjN88UKVE9feQwAJZLAAc1ujnooKZ4HU3kQSj 0P9ZMO+fH6Czq9wfgmJCAXPoA457xHYdHPir64haj8Dd3a8QWjTcudAvONrdCHi0Uaqw OsRGlAlJMSh7CvX4nHwD2ypOIZ7yjsWiS4UGEweC1GsqSha4mPhfM3JrvVXmP5JB9MD0 c2RrrAehCRnK4j3CZz6wrD3S//dQw9MbchPXL2q/C8SxdgDrVJdG06bazclDzvORkayc sMkIDkXsg08BnpgsxgnGRS0uxZQzg9phH3AZ9AU9/4cqDGHfqI+5IEi1OmRlTOy3PYq3 Eg2w== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:dkim-signature; bh=Dmxmbmzsg2EhhEhNmLq6u84yUQFlOgWHFAisBwRCjpo=; fh=zydHuzCQWrku2OPQyZfraJZFcOpEXLQ/YBcu3QNiBd0=; b=KZb8dwqOl4kNSxLVxEvyTK9hdCT8YqmHzmuEE47aw0wcJqjkUZ2YeJPzSwRNjkaw2d UnTb3qM0psjgWGxInVyeapS1PgspLYLMTiR3sysd8QCpkPb5FH2i4mFas/vuKs4b1fvd F3s+8/z8sjv8TCaIUqDIcnPFKAnJuTVCd24fzOvMo1Z7nI5+XmyzzTSmjLWAxPSXpuJx v8kSk2u8cUgUm9KYKPnC0UcMFZydjU4lFDcgvCCeiOznwbAK9UUcNvfCK1VNh8i+01lh CzPnxcDNI7TWA9bfs8PPZ0syvU8hPPT7CtMLITawh3Qxwclwsf+XkSjpoVyfSVB+TIYQ VfhQ== ARC-Authentication-Results: i=1; gmr-mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=CxJkJ0oY; spf=pass (google.com: domain of m.glembo@gmail.com designates 2a00:1450:4864:20::62b as permitted sender) smtp.mailfrom=m.glembo@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Received: from mail-ej1-x62b.google.com (mail-ej1-x62b.google.com. [2a00:1450:4864:20::62b]) by gmr-mx.google.com with ESMTPS id x10-20020a5d6b4a000000b00332c094fc56si469225wrw.5.2023.12.04.02.06.27 for (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Mon, 04 Dec 2023 02:06:27 -0800 (PST) Received-SPF: pass (google.com: domain of m.glembo@gmail.com designates 2a00:1450:4864:20::62b as permitted sender) client-ip=2a00:1450:4864:20::62b; Received: by mail-ej1-x62b.google.com with SMTP id a640c23a62f3a-a195a1474easo411239966b.2 for ; Mon, 04 Dec 2023 02:06:27 -0800 (PST) X-Received: by 2002:a17:906:4816:b0:a18:9bf9:2edc with SMTP id w22-20020a170906481600b00a189bf92edcmr4556260ejq.43.1701684386634; Mon, 04 Dec 2023 02:06:26 -0800 (PST) Received: from PC-2635.irisgmbh.local (dslb-002-203-161-041.002.203.pools.vodafone-ip.de. [2.203.161.41]) by smtp.gmail.com with ESMTPSA id js22-20020a17090797d600b00a1b32663d7csm2032919ejc.102.2023.12.04.02.06.25 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Mon, 04 Dec 2023 02:06:25 -0800 (PST) From: Michael Glembotzki To: swupdate@googlegroups.com Cc: Michael Glembotzki Subject: [swupdate] [V2][PATCH 02/10] util: BUG: __swupdate_copy accepts invalid ivt Date: Mon, 4 Dec 2023 11:05:34 +0100 Message-ID: <20231204100620.27789-3-Michael.Glembotzki@iris-sensing.com> X-Mailer: git-send-email 2.42.0 In-Reply-To: <20231204100620.27789-1-Michael.Glembotzki@iris-sensing.com> References: <20231204100620.27789-1-Michael.Glembotzki@iris-sensing.com> MIME-Version: 1.0 X-Original-Sender: m.glembo@gmail.com X-Original-Authentication-Results: gmr-mx.google.com; dkim=pass header.i=@gmail.com header.s=20230601 header.b=CxJkJ0oY; spf=pass (google.com: domain of m.glembo@gmail.com designates 2a00:1450:4864:20::62b as permitted sender) smtp.mailfrom=m.glembo@gmail.com; dmarc=pass (p=NONE sp=QUARANTINE dis=NONE) header.from=gmail.com Precedence: list Mailing-list: list swupdate@googlegroups.com; contact swupdate+owners@googlegroups.com List-ID: X-Spam-Checked-In-Group: swupdate@googlegroups.com X-Google-Group-Id: 605343134186 List-Post: , List-Help: , List-Archive: , List-Unsubscribe: , Signed-off-by: Michael Glembotzki --- core/cpio_utils.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/core/cpio_utils.c b/core/cpio_utils.c index 2e5f19a..7049f73 100644 --- a/core/cpio_utils.c +++ b/core/cpio_utils.c @@ -514,9 +514,11 @@ static int __swupdate_copy(int fdin, unsigned char *inbuf, void *out, size_t nby if (encrypted) { aes_key = get_aes_key(); - if (imgivt && strlen(imgivt)) { - if(ascii_to_bin(ivtbuf, sizeof(ivtbuf), imgivt)) { - ERROR("invalid image ivt length"); + if (imgivt) { + if (strlen(imgivt) != (AES_BLK_SIZE * 2) || + is_hex_str(imgivt) || + ascii_to_bin(ivtbuf, sizeof(ivtbuf), imgivt)) { + ERROR("invalid image ivt"); return -EINVAL; } ivt = ivtbuf;