[PATCH][libubootenv] uboot_env: Reject too small configured environment sizes

[Christian Storm]

Validate ctx->size against the actual header offset, preventing
unsigned underflow of payload space (libuboot_env_store) and
usable_envsize calculation (libuboot_load).

Signed-off-by: Christian Storm <christi...@siemens.com>
---
src/uboot_env.c | 19 ++++++++++---------
1 file changed, 10 insertions(+), 9 deletions(-)

diff --git a/src/uboot_env.c b/src/uboot_env.c
index 087cab6..30c9cbb 100644
--- a/src/uboot_env.c
+++ b/src/uboot_env.c
@@ -541,18 +541,16 @@ int libuboot_env_store(struct uboot_ctx *ctx)
int ret;
int copy;

- /*
- * Allocate the bigger of the case
- */
- image = malloc(sizeof(struct uboot_env_redund) + ctx->size);
+ offsetdata = ctx->redundant
+ ? offsetof(struct uboot_env_redund, data)
+ : offsetof(struct uboot_env_noredund, data);
+ if (ctx->size <= offsetdata)
+ return -EINVAL;
+
+ image = malloc(ctx->size);
if (!image)
return -ENOMEM;

- if (ctx->redundant)
- offsetdata = offsetof(struct uboot_env_redund, data);
- else
- offsetdata = offsetof(struct uboot_env_noredund, data);
-
data = (char *)(image + offsetdata);

buf = data;
@@ -650,6 +648,9 @@ static int libuboot_load(struct uboot_ctx *ctx)
offsetdata = offsetof(struct uboot_env_redund, data);
offsetcrc = offsetof(struct uboot_env_redund, crc);
}
+ if (ctx->size <= offsetdata)
+ return -EINVAL;
+
usable_envsize = ctx->size - offsetdata;
buf[0] = malloc(bufsize);
if (!buf[0])
--
2.55.0

[Stefano Babic]

Applied to -master, thanks !

Best regards,
Stefano

--
_______________________________________________________________________
Nabla Software Engineering GmbH
Hirschstr. 111A | 86156 Augsburg | Tel: +49 821 45592596
Geschäftsführer : Stefano Babic | HRB 40522 Augsburg
E-Mail: sba...@nabladev.com