diff mbox series

[V4,1/8] parser: BUG: Image IVT with invalid size is accepted

Message ID 20240115192845.51530-2-Michael.Glembotzki@iris-sensing.com
State New
Delegated to: Stefano Babic
Headers show
Series Add support for asymmetric decryption | expand

Commit Message

Michael Glembotzki Jan. 15, 2024, 7:26 p.m. UTC 
An IVT with invalid size is currently accepted. Make an explicit size check
before setting the image IVT.

Signed-off-by: Michael Glembotzki <Michael.Glembotzki@iris-sensing.com>
---
 parser/parser.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)
diff mbox series

Patch

diff --git a/parser/parser.c b/parser/parser.c
index e13992e..67ae1b3 100644
--- a/parser/parser.c
+++ b/parser/parser.c
@@ -393,6 +393,22 @@  static int run_embscript(parsertype p, void *elem, struct img_type *img,
 	return lua_parser_fn(L, embfcn, img);
 }
 
+static void get_ivt_value(parsertype p, void *elem, char *ivt_ascii)
+{
+	size_t ivtlen;
+	const char *s = NULL;
+
+	s = get_field_string(p, elem, "ivt");
+	if (s) {
+		ivtlen = strnlen(s, SWUPDATE_GENERAL_STRING_SIZE);
+		if (ivtlen != (AES_BLK_SIZE * 2)) {
+			ERROR("Invalid ivt length");
+			return;
+		}
+		strncpy(ivt_ascii, s, ivtlen);
+	}
+}
+
 static int parse_common_attributes(parsertype p, void *elem, struct img_type *image, struct swupdate_cfg *cfg)
 {
 	char seek_str[MAX_SEEK_STRING_SIZE];
@@ -451,7 +467,7 @@  static int parse_common_attributes(parsertype p, void *elem, struct img_type *im
 	get_field(p, elem, "install-if-different", &image->id.install_if_different);
 	get_field(p, elem, "install-if-higher", &image->id.install_if_higher);
 	get_field(p, elem, "encrypted", &image->is_encrypted);
-	GET_FIELD_STRING(p, elem, "ivt", image->ivt_ascii);
+	get_ivt_value(p, elem, image->ivt_ascii);
 
 	if (is_image_installed(&cfg->installed_sw_list, image)) {
 		image->skip = SKIP_SAME;