kwbimage: Fix out of bounds access

The kwbimage format is reading beyond its header structure if it
misdetects a Xilinx Zynq image and tries to read it. Fix it by
sanity checking that the header we want to read fits inside our
file size.

Signed-off-by: Alexander Graf <agraf@suse.de>
Signed-off-by: Michal Simek <michal.simek@xilinx.com>

diff --git a/tools/kwbimage.c b/tools/kwbimage.c
index ccecf8718537b04250a252adbf91f56ba6509772..df7daa4d6c81b7bb626bdd6af2b021e0335de423 100644 (file)
--- a/tools/kwbimage.c
+++ b/tools/kwbimage.c
@@ -1615,6 +1615,10 @@ static int kwbimage_verify_header(unsigned char *ptr, int image_size,
                                  struct image_tool_params *params)
 {
        uint8_t checksum;
+       size_t header_size = kwbimage_header_size(ptr);
+
+       if (header_size > image_size)
+               return -FDT_ERR_BADSTRUCTURE;
 
        if (!main_hdr_checksum_ok(ptr))
                return -FDT_ERR_BADSTRUCTURE;