From 2d1b2ac13fe5be6aa149e7a8ab5b059f0ad05476 Mon Sep 17 00:00:00 2001 From: Mikhail Ilin Date: Fri, 18 Nov 2022 14:50:24 +0300 Subject: [PATCH] tool: ifwitool: Fix buffer overflow An incorrect 1st parameter is passed to the fix_member() function. Should use a pointer to the beginning of the parent structure (bpdt or subpart_dir, because are boxed), not to their fields. Otherwise, this leads to an overrun of the structure boundary, since in the fix_member() function, an 'offset' is made, relative to the 1st argument, which itself is an 'offset' from the beginning of the structure. Signed-off-by: Mikhail Ilin Reviewed-by: Simon Glass --- tools/ifwitool.c | 44 +++++++++++++++++++------------------------- 1 file changed, 19 insertions(+), 25 deletions(-) diff --git a/tools/ifwitool.c b/tools/ifwitool.c index a06eb7f33d..31591863b2 100644 --- a/tools/ifwitool.c +++ b/tools/ifwitool.c @@ -1441,23 +1441,20 @@ static void bpdt_fixup_write_buffer(struct buffer *buf) size_t offset = 0; - offset = fix_member(&h->signature, offset, sizeof(h->signature)); - offset = fix_member(&h->descriptor_count, offset, - sizeof(h->descriptor_count)); - offset = fix_member(&h->bpdt_version, offset, sizeof(h->bpdt_version)); - offset = fix_member(&h->xor_redundant_block, offset, - sizeof(h->xor_redundant_block)); - offset = fix_member(&h->ifwi_version, offset, sizeof(h->ifwi_version)); - offset = fix_member(&h->fit_tool_version, offset, - sizeof(h->fit_tool_version)); + offset = fix_member(&s, offset, sizeof(h->signature)); + offset = fix_member(&s, offset, sizeof(h->descriptor_count)); + offset = fix_member(&s, offset, sizeof(h->bpdt_version)); + offset = fix_member(&s, offset, sizeof(h->xor_redundant_block)); + offset = fix_member(&s, offset, sizeof(h->ifwi_version)); + offset = fix_member(&s, offset, sizeof(h->fit_tool_version)); uint32_t i; for (i = 0; i < count; i++) { - offset = fix_member(&e[i].type, offset, sizeof(e[i].type)); - offset = fix_member(&e[i].flags, offset, sizeof(e[i].flags)); - offset = fix_member(&e[i].offset, offset, sizeof(e[i].offset)); - offset = fix_member(&e[i].size, offset, sizeof(e[i].size)); + offset = fix_member(&s, offset, sizeof(e[i].type)); + offset = fix_member(&s, offset, sizeof(e[i].flags)); + offset = fix_member(&s, offset, sizeof(e[i].offset)); + offset = fix_member(&s, offset, sizeof(e[i].size)); } } @@ -1657,24 +1654,21 @@ static void subpart_dir_fixup_write_buffer(struct buffer *buf) size_t count = h->num_entries; size_t offset = 0; - offset = fix_member(&h->marker, offset, sizeof(h->marker)); - offset = fix_member(&h->num_entries, offset, sizeof(h->num_entries)); - offset = fix_member(&h->header_version, offset, - sizeof(h->header_version)); - offset = fix_member(&h->entry_version, offset, - sizeof(h->entry_version)); - offset = fix_member(&h->header_length, offset, - sizeof(h->header_length)); - offset = fix_member(&h->checksum, offset, sizeof(h->checksum)); + offset = fix_member(&s, offset, sizeof(h->marker)); + offset = fix_member(&s, offset, sizeof(h->num_entries)); + offset = fix_member(&s, offset, sizeof(h->header_version)); + offset = fix_member(&s, offset, sizeof(h->entry_version)); + offset = fix_member(&s, offset, sizeof(h->header_length)); + offset = fix_member(&s, offset, sizeof(h->checksum)); offset += sizeof(h->name); uint32_t i; for (i = 0; i < count; i++) { offset += sizeof(e[i].name); - offset = fix_member(&e[i].offset, offset, sizeof(e[i].offset)); - offset = fix_member(&e[i].length, offset, sizeof(e[i].length)); - offset = fix_member(&e[i].rsvd, offset, sizeof(e[i].rsvd)); + offset = fix_member(&s, offset, sizeof(e[i].offset)); + offset = fix_member(&s, offset, sizeof(e[i].length)); + offset = fix_member(&s, offset, sizeof(e[i].rsvd)); } }