Re: [PATCH 4/4] spl: fit: Bound external data like U-Boot proper

Simon Glass <[email protected]> Wed, 5 Aug 2026 15:49:37 -0600

Newsgroups	gmane.comp.boot-loaders.u-boot
Message-ID	<CAFLszTgsCJXAnEkS2eUWqwW9iE3Y7_XithnDQzaNiVnNr18X+g__8810.64261063642$1785966607$gmane$org@mail.gmail.com>

On 2026-07-30T15:03:40, Anton Ivanov <[email protected]> wrote:
> spl: fit: Bound external data like U-Boot proper
>
> fit_image_get_data() checks that the external-data region fits in the
> addressable range and, for signed FITs, stays below
> FIT_SIGNATURE_MAX_SIZE. The SPL loader had no equivalent check, so a
> hostile data-offset or data-size could make the read offset wrap past
> ULONG_MAX, or the destination range wrap around the end of the address
> space.
>
> Add the same check to load_simple_fit(), using the block-aligned read
> size and the source pointer the read actually uses.
>
> Signed-off-by: Anton Ivanov <[email protected]>
>
> common/spl/spl_fit.c  | 26 ++++++++++++++++++++++++++
>  test/image/spl_load.c | 23 +++++++++++++++++++++++
>  2 files changed, 49 insertions(+)

Reviewed-by: Simon Glass <[email protected]>