From 328bc5b8c2b3297242441890e072530a6c72c0c2 Mon Sep 17 00:00:00 2001 From: Ville Juven Date: Tue, 6 Sep 2022 09:39:19 +0300 Subject: [PATCH] image_toc.c: Check that the ToC actually lies within the first entry As the first entry is used to sign / authenticate the ToC, make sure the ToC is actually in the first entry. --- platforms/nuttx/src/bootloader/common/image_toc.c | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/platforms/nuttx/src/bootloader/common/image_toc.c b/platforms/nuttx/src/bootloader/common/image_toc.c index cdc6ca9db37..3d8494f6daf 100644 --- a/platforms/nuttx/src/bootloader/common/image_toc.c +++ b/platforms/nuttx/src/bootloader/common/image_toc.c @@ -57,6 +57,7 @@ bool find_toc(const image_toc_entry_t **toc_entries, uint8_t *len) int i = 0; uint8_t sig_idx; const uint32_t toc_end_magic = TOC_END_MAGIC; + uintptr_t toc_end_u32; if (toc_start->magic == TOC_START_MAGIC && toc_start->version <= TOC_VERSION) { @@ -68,12 +69,16 @@ bool find_toc(const image_toc_entry_t **toc_entries, uint8_t *len) i++; } - /* The number of toc entries found must be within bounds, and the - * application has to lie within the flashable area. Also ensure that + toc_end_u32 = (uintptr_t)&entry[i] + sizeof(toc_end_magic); + + /* The number of ToC entries found must be within bounds, and the + * ToC has to lie within the flashable area. Also ensure that * end > start. */ if (i <= MAX_TOC_ENTRIES && i > 0 && + toc_start_u32 >= (uintptr_t)entry[0].start && + toc_end_u32 < (uintptr_t)entry[0].end && (uintptr_t)entry[0].start == APP_LOAD_ADDRESS && (uintptr_t)entry[0].end <= (FLASH_END_ADDRESS - sizeof(uintptr_t)) && (uintptr_t)entry[0].end > (uintptr_t)entry[0].start) {