diff options
| author | Uwe Kleine-König <u.kleine-koenig@pengutronix.de> | 2017-08-04 17:59:56 +0200 |
|---|---|---|
| committer | Lucas Stach <l.stach@pengutronix.de> | 2017-08-15 15:12:49 +0200 |
| commit | 7597d8e33289bacf57908552b12896062a8ddd4d (patch) | |
| tree | 305cdcc7ab7cb308d418cab06d9005a99edbcf04 /scripts | |
| parent | 1439cdf7c6fcee23b5734da8eb2b14d89309d00a (diff) | |
| download | barebox-7597d8e33289bacf57908552b12896062a8ddd4d.tar.gz barebox-7597d8e33289bacf57908552b12896062a8ddd4d.tar.xz | |
scripts/imx: fix out-of-bounds access for big DCD tables
add_header_v2 might need a buffer that is bigger than HEADER_LEN
(0x1000) as MAX_DCD * sizeof(u32) (i.e. the maximal size of the dcd
table alone) is already 0x1000. Additionally add_header_v2 adds padding
(usually 0x400) and a struct imx_flash_header_v2 (48). So expand the
buffer size accordingly for v2.
Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Diffstat (limited to 'scripts')
| -rw-r--r-- | scripts/imx/imx-image.c | 12 |
1 files changed, 8 insertions, 4 deletions
diff --git a/scripts/imx/imx-image.c b/scripts/imx/imx-image.c index dd5799cccc..b241e8c4b6 100644 --- a/scripts/imx/imx-image.c +++ b/scripts/imx/imx-image.c @@ -762,10 +762,6 @@ int main(int argc, char *argv[]) create_usb_image = 0; } - buf = calloc(1, HEADER_LEN); - if (!buf) - exit(1); - if (data.image_dcd_offset == 0xffffffff) { if (create_usb_image) data.image_dcd_offset = 0x0; @@ -790,6 +786,10 @@ int main(int argc, char *argv[]) switch (data.header_version) { case 1: + buf = calloc(1, HEADER_LEN); + if (!buf) + exit(1); + add_header_v1(&data, buf); if (data.srkfile) { ret = add_srk(buf, data.image_dcd_offset, data.image_load_addr, @@ -799,6 +799,10 @@ int main(int argc, char *argv[]) } break; case 2: + buf = calloc(1, data.image_dcd_offset + sizeof(struct imx_flash_header_v2) + MAX_DCD * sizeof(u32)); + if (!buf) + exit(1); + add_header_v2(&data, buf); break; default: |