[PATCH master] filetype: fix OOB read when detecting type of truncated kernel images

[PATCH master] filetype: fix OOB read when detecting type of truncated kernel images

[Ahmad Fatoum]

The ARM and RISC-V kernel Image format features a 64-byte header and
places the 32-bit magic value identifying it at offset 56.

The check for the magic values should thus ensure that at least 56 bytes
are guaranteed to be available in the buffer, thus move it into
the >= 64 byte segment of the function.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 common/filetype.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/common/filetype.c b/common/filetype.c
index f922494500d5..db65d1ece25a 100644
--- a/common/filetype.c
+++ b/common/filetype.c
@@ -319,12 +319,7 @@ enum filetype file_detect_type(const void *_buf, size_t bufsize)
 		return filetype_mips_barebox;
 	if (buf[0] == be32_to_cpu(0x534F4659))
 		return filetype_bpk;
-	if (le32_to_cpu(buf[14]) == 0x644d5241)
-		return is_dos_exe(buf8) ? filetype_arm64_efi_linux_image : filetype_arm64_linux_image;
-	if (le32_to_cpu(buf[14]) == 0x05435352)
-		return is_dos_exe(buf8) ? filetype_riscv_efi_linux_image : filetype_riscv_linux_image;
-	if (le32_to_cpu(buf[14]) == 0x56435352 && !memcmp(&buf[12], "barebox", 8))
-		return filetype_riscv_barebox_image;
+
 	if (strncmp(buf8, "RKNS", 4) == 0)
 		return filetype_rockchip_rkns_image;
 	if (le32_to_cpu(buf[0]) == le32_to_cpu(0xaa640001))
@@ -369,6 +364,13 @@ enum filetype file_detect_type(const void *_buf, size_t bufsize)
 	if (bufsize < 64)
 		return filetype_unknown;
 
+	if (le32_to_cpu(buf[14]) == 0x644d5241)
+		return is_dos_exe(buf8) ? filetype_arm64_efi_linux_image : filetype_arm64_linux_image;
+	if (le32_to_cpu(buf[14]) == 0x05435352)
+		return is_dos_exe(buf8) ? filetype_riscv_efi_linux_image : filetype_riscv_linux_image;
+	if (le32_to_cpu(buf[14]) == 0x56435352 && !memcmp(&buf[12], "barebox", 8))
+		return filetype_riscv_barebox_image;
+
 	if (le32_to_cpu(buf[5]) == 0x504d5453)
 		return filetype_mxs_bootstream;
 
-- 
2.39.2

Re: [PATCH master] filetype: fix OOB read when detecting type of truncated kernel images

[Sascha Hauer]

On Fri, 17 May 2024 09:47:35 +0200, Ahmad Fatoum wrote:
> The ARM and RISC-V kernel Image format features a 64-byte header and
> places the 32-bit magic value identifying it at offset 56.
> 
> The check for the magic values should thus ensure that at least 56 bytes
> are guaranteed to be available in the buffer, thus move it into
> the >= 64 byte segment of the function.
> 
> [...]

Applied, thanks!

[1/1] filetype: fix OOB read when detecting type of truncated kernel images
      https://git.pengutronix.de/cgit/barebox/commit/?id=0b12b757feaa (link may not be stable)

Best regards,
-- 
Sascha Hauer <s.hauer@pengutronix.de>