From: "Uwe Kleine-König" <u.kleine-koenig@pengutronix.de>
To: barebox@lists.infradead.org
Subject: [PATCH] scripts/imx: fix out-of-bounds access for big DCD tables
Date: Fri, 4 Aug 2017 17:59:56 +0200 [thread overview]
Message-ID: <20170804155956.19105-1-u.kleine-koenig@pengutronix.de> (raw)
add_header_v2 might need a buffer that is bigger than HEADER_LEN
(0x1000) as MAX_DCD * sizeof(u32) (i.e. the maximal size of the dcd
table alone) is already 0x1000. Additionally add_header_v2 adds padding
(usually 0x400) and a struct imx_flash_header_v2 (48). So expand the
buffer size accordingly for v2.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
---
scripts/imx/imx-image.c | 12 ++++++++----
1 file changed, 8 insertions(+), 4 deletions(-)
diff --git a/scripts/imx/imx-image.c b/scripts/imx/imx-image.c
index dd5799cccc4b..b241e8c4b68e 100644
--- a/scripts/imx/imx-image.c
+++ b/scripts/imx/imx-image.c
@@ -762,10 +762,6 @@ int main(int argc, char *argv[])
create_usb_image = 0;
}
- buf = calloc(1, HEADER_LEN);
- if (!buf)
- exit(1);
-
if (data.image_dcd_offset == 0xffffffff) {
if (create_usb_image)
data.image_dcd_offset = 0x0;
@@ -790,6 +786,10 @@ int main(int argc, char *argv[])
switch (data.header_version) {
case 1:
+ buf = calloc(1, HEADER_LEN);
+ if (!buf)
+ exit(1);
+
add_header_v1(&data, buf);
if (data.srkfile) {
ret = add_srk(buf, data.image_dcd_offset, data.image_load_addr,
@@ -799,6 +799,10 @@ int main(int argc, char *argv[])
}
break;
case 2:
+ buf = calloc(1, data.image_dcd_offset + sizeof(struct imx_flash_header_v2) + MAX_DCD * sizeof(u32));
+ if (!buf)
+ exit(1);
+
add_header_v2(&data, buf);
break;
default:
--
2.11.0
_______________________________________________
barebox mailing list
barebox@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/barebox
reply other threads:[~2017-08-04 16:00 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20170804155956.19105-1-u.kleine-koenig@pengutronix.de \
--to=u.kleine-koenig@pengutronix.de \
--cc=barebox@lists.infradead.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox