mail archive of the barebox mailing list
 help / color / mirror / Atom feed
* [PATCH master] filetype: fix OOB read when detecting type of truncated kernel images
@ 2024-05-17  7:47 Ahmad Fatoum
  2024-05-21  6:37 ` Sascha Hauer
  0 siblings, 1 reply; 2+ messages in thread
From: Ahmad Fatoum @ 2024-05-17  7:47 UTC (permalink / raw)
  To: barebox; +Cc: Ahmad Fatoum

The ARM and RISC-V kernel Image format features a 64-byte header and
places the 32-bit magic value identifying it at offset 56.

The check for the magic values should thus ensure that at least 56 bytes
are guaranteed to be available in the buffer, thus move it into
the >= 64 byte segment of the function.

Signed-off-by: Ahmad Fatoum <a.fatoum@pengutronix.de>
---
 common/filetype.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/common/filetype.c b/common/filetype.c
index f922494500d5..db65d1ece25a 100644
--- a/common/filetype.c
+++ b/common/filetype.c
@@ -319,12 +319,7 @@ enum filetype file_detect_type(const void *_buf, size_t bufsize)
 		return filetype_mips_barebox;
 	if (buf[0] == be32_to_cpu(0x534F4659))
 		return filetype_bpk;
-	if (le32_to_cpu(buf[14]) == 0x644d5241)
-		return is_dos_exe(buf8) ? filetype_arm64_efi_linux_image : filetype_arm64_linux_image;
-	if (le32_to_cpu(buf[14]) == 0x05435352)
-		return is_dos_exe(buf8) ? filetype_riscv_efi_linux_image : filetype_riscv_linux_image;
-	if (le32_to_cpu(buf[14]) == 0x56435352 && !memcmp(&buf[12], "barebox", 8))
-		return filetype_riscv_barebox_image;
+
 	if (strncmp(buf8, "RKNS", 4) == 0)
 		return filetype_rockchip_rkns_image;
 	if (le32_to_cpu(buf[0]) == le32_to_cpu(0xaa640001))
@@ -369,6 +364,13 @@ enum filetype file_detect_type(const void *_buf, size_t bufsize)
 	if (bufsize < 64)
 		return filetype_unknown;
 
+	if (le32_to_cpu(buf[14]) == 0x644d5241)
+		return is_dos_exe(buf8) ? filetype_arm64_efi_linux_image : filetype_arm64_linux_image;
+	if (le32_to_cpu(buf[14]) == 0x05435352)
+		return is_dos_exe(buf8) ? filetype_riscv_efi_linux_image : filetype_riscv_linux_image;
+	if (le32_to_cpu(buf[14]) == 0x56435352 && !memcmp(&buf[12], "barebox", 8))
+		return filetype_riscv_barebox_image;
+
 	if (le32_to_cpu(buf[5]) == 0x504d5453)
 		return filetype_mxs_bootstream;
 
-- 
2.39.2




^ permalink raw reply	[flat|nested] 2+ messages in thread

end of thread, other threads:[~2024-05-21  6:37 UTC | newest]

Thread overview: 2+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-05-17  7:47 [PATCH master] filetype: fix OOB read when detecting type of truncated kernel images Ahmad Fatoum
2024-05-21  6:37 ` Sascha Hauer

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox