Commit Graph

7 Commits (2fdc99f323f1663a5cd551c032bdf7e9b34b2a09)

Author SHA1 Message Date
Daniele Lacamera 71545e96de F-4339: widen uart-flash-server bounds checks to 64-bit to stop uint32_t wrap
uart_flash_erase/read/write read attacker-controlled address and len as raw
4-byte words from the UART peer and guard the mmap region with
`address + len > FIRMWARE_PARTITION_SIZE + SWAP_SIZE`. The addition is done in
uint32_t, so a large len (e.g. 0xFFFFFFFF) wraps the sum below 0x21000 and the
guard passes, after which the loop walks far past the 0x21000-byte mapping —
SIGSEGV on a 64-bit host, or wrapped writes over the firmware header on 32-bit.

Compute address + len in uint64_t before the comparison so the sum cannot wrap.
Add a pty-driven regression test (test_overflow) and a `make test` target that
sends an ERASE with a wrapping address+len and asserts the server survives.
2026-06-10 21:01:16 +02:00
David Garske 69ca95eb94 Adds `factory_wstage1.bin` option to include first stage loader. Fix test-app verbose issue. 2023-04-21 16:41:00 +02:00
David Garske f283929161 Improvements to gap fill. The default gap filling byte is `0xFF`. If using `FLAGS_INVERT=1` uses `0x00`. Can be overridden at build-time using `FILL_BYTE`. Fixes ZD 15356. 2022-12-19 11:38:00 +01:00
David Garske da6d364f1e Fixes for encrypt/decrypt with unaligned address. Fix issue with byte count result on Mac. Cleanups for uart-flash-server. 2022-12-16 17:50:02 +01:00
Daniele Lacamera 71cb839a07 uart-flash-server: build own libwolfboot.o 2021-12-15 14:57:57 +01:00
Daniele Lacamera 64134ded1f Minor fixes from code review 2020-06-18 18:43:50 +02:00
Daniele Lacamera 7ffcdca098 External, emulated non-volatile memory over UART 2020-04-03 14:27:42 +02:00