Re: [PATCH v1 1/3] lib: aes: reject a ciphertext length that is not a whole number of blocks

On 2026-08-15T22:07:52, Pranav Rajendran <[email protected]> wrote:
> lib: aes: reject a ciphertext length that is not a whole number of blocks
>
> image_aes_decrypt() allocates cipher_len bytes for the plaintext but
> then asks aes_cbc_decrypt_blocks() to write
> DIV_ROUND_UP(cipher_len, AES_BLOCK_LENGTH) blocks into it. For a
> cipher_len that is not a multiple of AES_BLOCK_LENGTH the rounding up
> adds one block, so the last block is written up to AES_BLOCK_LENGTH - 1
> bytes past the end of the allocation, and read the same distance past
> the end of the ciphertext.
>
> cipher_len is the size of the image data in the FIT, so an image with a
> 'data' property whose length is not block aligned is enough to reach
> this. The overflowing bytes are decryption output, i.e. they depend on
> the key, but the length itself is not covered by anything that would
> stop the image from being parsed this far.
>
> A CBC ciphertext is a whole number of blocks by construction, so treat
> anything else as a malformed image and reject it before allocating.
> With that established, compute the block count with a plain division so
> the buffer size and the write length cannot drift apart again.
>
> Fixes: 4df3578119b0 ("u-boot: fit: add support to decrypt fit with aes")
> Signed-off-by: Pranav Rajendran <[email protected]>
>
> lib/aes/aes-decrypt.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)

Reviewed-by: Simon Glass <[email protected]>