From fccde618fc180baafbbb265ac787a4486307655c Mon Sep 17 00:00:00 2001 From: Alexander Graf Date: Thu, 15 Mar 2018 11:14:19 +0100 Subject: [PATCH] kwbimage: Fix out of bounds access The kwbimage format is reading beyond its header structure if it misdetects a Xilinx Zynq image and tries to read it. Fix it by sanity checking that the header we want to read fits inside our file size. Signed-off-by: Alexander Graf Signed-off-by: Michal Simek --- tools/kwbimage.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/kwbimage.c b/tools/kwbimage.c index ccecf87185..df7daa4d6c 100644 --- a/tools/kwbimage.c +++ b/tools/kwbimage.c @@ -1615,6 +1615,10 @@ static int kwbimage_verify_header(unsigned char *ptr, int image_size, struct image_tool_params *params) { uint8_t checksum; + size_t header_size = kwbimage_header_size(ptr); + + if (header_size > image_size) + return -FDT_ERR_BADSTRUCTURE; if (!main_hdr_checksum_ok(ptr)) return -FDT_ERR_BADSTRUCTURE;