From: Pali Rohár pali@kernel.org
The data part of v1 images contains 32-bit checksum after the data. Validate whether this checksum is correct.
Signed-off-by: Pali Rohár pali@kernel.org Reviewed-by: Marek Behún marek.behun@nic.cz --- tools/kwbimage.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 46 insertions(+)
diff --git a/tools/kwbimage.c b/tools/kwbimage.c index 5f7cb8376a..de6eb3f075 100644 --- a/tools/kwbimage.c +++ b/tools/kwbimage.c @@ -1670,6 +1670,9 @@ static int kwbimage_verify_header(unsigned char *ptr, int image_size,
if (image_version((void *)ptr) == 1) { struct main_hdr_v1 *mhdr = (struct main_hdr_v1 *)ptr; + unsigned char *endptr = ptr + sizeof(*mhdr); + uint32_t offset; + uint32_t size;
if (mhdr->ext & 0x1) { uint32_t ohdr_size; @@ -1693,7 +1696,50 @@ static int kwbimage_verify_header(unsigned char *ptr, int image_size, ohdr = (struct opt_hdr_v1 *)((uint8_t *)ohdr + 4 + ohdr_size + 4); } + + endptr = ((uint8_t *)ohdr + 4 + ohdr_size + 4); + } + + offset = le32_to_cpu(mhdr->srcaddr); + + /* + * For SATA srcaddr is specified in number of sectors. + * The main header is must be stored at sector number 1. + * This expects that sector size is 512 bytes and recalculates + * data offset to bytes relative to the main header. + */ + if (mhdr->blockid == IBR_HDR_SATA_ID) { + if (offset < 1) + return -FDT_ERR_BADSTRUCTURE; + offset -= 1; + offset *= 512; } + + /* + * For SDIO srcaddr is specified in number of sectors. + * This expects that sector size is 512 bytes and recalculates + * data offset to bytes. + */ + if (mhdr->blockid == IBR_HDR_SDIO_ID) + offset *= 512; + + /* + * For PCIe srcaddr is always set to 0xFFFFFFFF. + * This expects that data starts after all headers. + */ + if (mhdr->blockid == IBR_HDR_PEX_ID && offset == 0xFFFFFFFF) + offset = endptr - ptr; + + if (offset > image_size || offset % 4 != 0) + return -FDT_ERR_BADSTRUCTURE; + + size = le32_to_cpu(mhdr->blocksize); + if (offset + size > image_size || size % 4 != 0) + return -FDT_ERR_BADSTRUCTURE; + + if (image_checksum32(ptr + offset, size - 4) != + *(uint32_t *)(ptr + offset + size - 4)) + return -FDT_ERR_BADSTRUCTURE; }
return 0;