Re: [PATCH v3 3/4] spl: fit: Harden external-data offset and size arithmetic

On 2026-08-10T22:09:53, Anton Ivanov <[email protected]> wrote:
> spl: fit: Harden external-data offset and size arithmetic
>
> The data-offset, data-position and data-size FIT properties are
> excluded from the configuration signature, so they are attacker
> controlled even when signature verification succeeds. The offset and
> size arithmetic in load_simple_fit() can wrap on hostile values:
>
>  - adding the external-data base offset to data-offset can wrap past
>    UINT32_MAX,
>  - get_aligned_image_size() adds the block-alignment overhead and
>    rounds up to the block length, which can wrap past ULONG_MAX,
>  - adding the FIT's device offset to the aligned external-data offset
>    can wrap past ULONG_MAX.
>
> Make get_aligned_image_size() return the aligned size through an out
> parameter and fail with -EOVERFLOW when the computation would wrap,
> check the two offset additions explicitly, and compare the
> block-aligned size (the amount info->read() actually transfers)
> against max_size before reading. Do the same for the FIT header read
> in spl_simple_fit_read().
>
> Signed-off-by: Anton Ivanov <[email protected]>
>
> common/spl/spl_fit.c  | 98 +++++++++++++++++++++++++++++----------------------
>  test/image/spl_load.c | 57 ++++++++++++++++++++++++++++++
>  2 files changed, 112 insertions(+), 43 deletions(-)

Reviewed-by: Simon Glass <[email protected]>