A second -r replaced the ranges array without freeing the first (leak)
and silently discarded its ranges. Reject the repeat with a pointer to
the comma-separated form.
Verification: new tools/squashelf/test-repeat-range.py fails pre-fix
(repeated -r accepted), passes post-fix; full make -C tools/squashelf
test green (8/8).
The alignment round-up current_offset = (current_offset + p_align - 1) &
~(p_align - 1) used p_align straight from a (possibly crafted) program
header without bounds. For ELF64 a p_align near UINT64_MAX wraps the sum to
a tiny value (e.g. 0x78 -> 0); for ELF32 a value that rounds the offset past
2^32 is silently truncated when stored into the uint32_t offset field. Either
way segment data is written at a wrong (often zero) file offset, clobbering
the output ELF header while squashelf still reports success.
Reject such inputs: bound the round-up against UINT64_MAX before applying it
(both classes) and reject an ELF32 offset that exceeds UINT32_MAX. Normal
page-aligned segments are unaffected. Adds test-align-overflow.py covering
the ELF64 wrap, the ELF32 truncation, and the normal-segment regression.
In the PT_LOAD range filter, segmentEnd was computed as
p_paddr + p_memsz - 1 in uint64_t with no overflow check. Both fields
come straight from the (possibly crafted) ELF64 program header. When
p_paddr + p_memsz exceeds 2^64 the result wraps below p_paddr: the
wrapped end can land back inside the requested range, so a segment whose
true span lies entirely outside the range is spuriously included (and the
converse can silently drop a valid segment). squashelf would then emit a
squashed image that wolfBoot signs and boots.
Detect the overflow before computing segmentEnd and treat such a segment
as out-of-range. ELF32 cannot overflow a uint64 sum and is unaffected.
Adds tools/squashelf/test-range-overflow.py (run via `make test`) which
fails before the fix and passes after.
- Support ELF scatter-loading on TC3xx
- Modify TC3xx HAL flash erase to support arbitrary offsets and sizes
- Realign partition size and addresses to support more efficient sector mass erase on update
Daniele Lacamera
Brett Nicholas