WolfSSL
/
wolfBoot
mirror of https://github.com/wolfSSL/wolfBoot.git
1
0
Fork 0
Code Issues Releases Wiki Activity

F-6405: pin partition-fit accept boundary in wolfBoot_open_image_address/open_self_address 

The fw_size > (WOLFBOOT_PARTITION_SIZE - IMAGE_HEADER_SIZE) guard was only
tested on the reject side (oversize + 1); no test asserted that a firmware
payload exactly filling the partition payload budget is accepted. A >/>=
mutation at image.c:1402 or image.c:1618 would silently reject a
maximally-sized valid image and survive the existing suite. Add positive
boundary assertions (via wolfBoot_open_image()/wolfBoot_open_image_address()
and wolfBoot_open_self_address()) paired with the existing reject-side
checks in test_open_image.
pull/814/head
Daniele Lacamera 2026-07-02 16:05:38 +02:00
parent 102ddc38fd
commit dd16ccb590
1 changed files with 36 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

36
tools/unit-tests/unit-image.c
View File

@ -1028,6 +1028,29 @@ START_TEST(test_open_image)
ck_assert_int_eq(ret, -1);
ck_assert_uint_eq(img.hdr_ok, 0);
/* A firmware payload that exactly fills the partition payload budget
* (fw_size == WOLFBOOT_PARTITION_SIZE - IMAGE_HEADER_SIZE) must be
* accepted by the partition-fit check in wolfBoot_open_image_address(),
* with fw_base/trailer positioned right after the header / at the end
* of the partition. */
memset(self_hdr, 0xFF, sizeof(self_hdr));
((uint32_t *)self_hdr)[0] = WOLFBOOT_MAGIC;
((uint32_t *)self_hdr)[1] = WOLFBOOT_PARTITION_SIZE - IMAGE_HEADER_SIZE;
ext_flash_erase(0, WOLFBOOT_SECTOR_SIZE);
ext_flash_write(0, self_hdr, IMAGE_HEADER_SIZE);
memset(&img, 0, sizeof(img));
hdr_cpy_done = 0;
ret = wolfBoot_open_image(&img, PART_UPDATE);
ck_assert_int_eq(ret, 0);
ck_assert_uint_eq(img.hdr_ok, 1);
ck_assert_uint_eq(img.fw_size, WOLFBOOT_PARTITION_SIZE - IMAGE_HEADER_SIZE);
ck_assert_ptr_eq(img.fw_base, (uint8_t *)WOLFBOOT_PARTITION_UPDATE_ADDRESS
+ IMAGE_HEADER_SIZE);
ck_assert_ptr_eq(img.trailer, (uint8_t *)WOLFBOOT_PARTITION_UPDATE_ADDRESS
+ WOLFBOOT_PARTITION_SIZE);
/* Self header must reject bad magic and leave hdr_ok cleared */
memset(self_hdr, 0xFF, sizeof(self_hdr));
((uint32_t *)self_hdr)[0] = ~WOLFBOOT_MAGIC;
@ -1038,6 +1061,19 @@ START_TEST(test_open_image)
ck_assert_int_eq(ret, -1);
ck_assert_uint_eq(img.hdr_ok, 0);
/* Self header must accept sizes that exactly fill the partition
* payload budget (accept side of the same boundary checked below) */
memset(self_hdr, 0xFF, sizeof(self_hdr));
((uint32_t *)self_hdr)[0] = WOLFBOOT_MAGIC;
((uint32_t *)self_hdr)[1] = WOLFBOOT_PARTITION_SIZE - IMAGE_HEADER_SIZE;
memset(&img, 0, sizeof(img));
ret = wolfBoot_open_self_address(&img, self_hdr,
(uint8_t *)WOLFBOOT_PARTITION_BOOT_ADDRESS);
ck_assert_int_eq(ret, 0);
ck_assert_uint_eq(img.hdr_ok, 1);
ck_assert_uint_eq(img.fw_size, WOLFBOOT_PARTITION_SIZE - IMAGE_HEADER_SIZE);
/* Self header must reject sizes beyond the partition payload budget */
memset(self_hdr, 0xFF, sizeof(self_hdr));
((uint32_t *)self_hdr)[0] = WOLFBOOT_MAGIC;