Anton Ivanov 69f6272b24 image-fit: Validate external data offset and size ...

fit_image_get_data() uses the data-position, data-offset, and
data-size FIT properties without bounds checking. A crafted FIT
image can specify values that cause out-of-bounds read during
signature verification of an untrusted FIT.

Validate that the external data offset and size are non-negative,
and that the data region fits within the FIT image bounds.

Signed-off-by: Anton Ivanov <anton@binarly.io>
Reviewed-by: Simon Glass <sjg@chromium.org>

2026-06-12 15:38:27 -06:00

..

boot

test: boot: add runtime unit test for fit_verity_build_cmdline()

2026-05-27 13:41:33 -06:00

cmd

test: cmd: part: add UUID lookup tests

2026-05-12 15:52:01 +02:00

common

test: relax cread_test time constraint

2025-12-05 08:54:44 -06:00

dm

reset: sandbox: Cover reset_reset() fallback with second sandbox provider

2026-06-08 10:50:06 +02:00

env

global: Avoid indirect inclusion of <env.h> from <command.h>

2025-05-29 08:29:16 -06:00

fdt_overlay

test: Drop suites.h

2025-02-11 20:12:36 -06:00

fs

test: fs: fs-test: Move the tests to use sha256sum

2024-01-11 21:19:25 -05:00

fuzz

Kbuild: Always use $(PHASE_)

2025-04-11 12:16:44 -06:00

hush

cmd: test: add bug-compatibility special case for 'test -n'

2026-04-02 16:00:29 -06:00

image

spl: Create a function to init spl_load_info

2024-08-23 15:58:42 -06:00

lib

test: lib: add test of memdup_nul()

2026-05-12 15:38:00 -06:00

log

treewide: Clean up DECLARE_GLOBAL_DATA_PTR usage

2026-02-17 13:50:22 -06:00

optee

test: Fix optee unit test

2025-09-24 11:04:11 -06:00

py

image-fit: Validate external data offset and size

2026-06-12 15:38:27 -06:00

stdint

Revert "Merge patch series "arm: dts: am62-beagleplay: Fix Beagleplay Ethernet""

2024-05-19 08:16:36 -06:00

cmd_ut.c

test: boot: add runtime unit test for fit_verity_build_cmdline()

2026-05-27 13:41:33 -06:00

Kconfig

test: Correct dependencies for SPL_UNIT_TEST

2026-03-30 16:59:17 -06:00

Makefile

test: don't test for CONFIG_UNIT_TEST twice

2025-12-05 08:54:44 -06:00

run

test: Run the VPL tests with 'make check'

2023-04-03 06:53:53 +12:00

test-main.c

test: Remove not needed null check

2025-10-15 14:17:06 -06:00

ut.c

test: Move stats into a struct

2025-01-24 14:34:41 -06:00