mirror of https://github.com/wolfSSL/wolfBoot.git
d175c819cd
load_linux() computed the protected-mode kernel size as the uint32_t product param.hdr.syssize * 16 (src/x86/linux_loader.c), where syssize is copied verbatim from the (authenticated) bzImage at offset 0x1f4. The multiplication wraps for any syssize > 0x0FFFFFFF: syssize=0x10000000 yields kernel_size=0 (DoS), and syssize=0x1FFFFFFF/0xFFFFFFFF yields kernel_size=0xFFFFFFF0 (~4 GiB). That value fed straight into memcpy((uint8_t*)KERNEL_LOAD_ADDRESS, linux_image + param_size, kernel_size) with no cap, overwriting wolfBoot stage2, FSP data, and the heap (CWE-190 -> CWE-680). Fix at the root: linux_kernel_size() computes syssize * 16 in 64-bit and rejects the image (panic) when the result is zero or does not fit in the destination window [KERNEL_LOAD_ADDRESS, tolum). tolum is the top of low usable memory the FSP already reports and that the ELF boot path uses as its load upper bound (src/boot_x86_fsp_payload.c). The kernel load only runs under WOLFBOOT_FSP (the non-FSP path panics earlier at the memory map step), so tolum is always available there. Add unit-linux-loader-syssize regression test (x86 32bit, standalone) that feeds the PoC overflow values and asserts they are rejected while a legitimate kernel and the exact-fit boundary are accepted. |
||
|---|---|---|
| .. | ||
| Makefile | ||
| README.md | ||
| gpt-sfdisk-test.h | ||
| target.h | ||
| txt_filler.h | ||
| unit-boot-x86_fsp.c | ||
| unit-common.c | ||
| unit-delta.c | ||
| unit-disk.c | ||
| unit-enc-nvm.c | ||
| unit-extflash.c | ||
| unit-fdt.c | ||
| unit-fit-gzip.c | ||
| unit-fwtpm-stub.c | ||
| unit-gzip.c | ||
| unit-image.c | ||
| unit-keygen-xmss-params.c | ||
| unit-keystore.c | ||
| unit-linux-loader-e820.c | ||
| unit-linux-loader-syssize.c | ||
| unit-loader-tpm-init.c | ||
| unit-max-space.c | ||
| unit-mock-flash.c | ||
| unit-mock-state.c | ||
| unit-multiboot.c | ||
| unit-nvm.c | ||
| unit-parser.c | ||
| unit-pci.c | ||
| unit-pkcs11_store.c | ||
| unit-policy-create.c | ||
| unit-policy-sign.c | ||
| unit-psa_store.c | ||
| unit-qspi-flash.c | ||
| unit-rot-auth.c | ||
| unit-sdhci-disk-unaligned.c | ||
| unit-sdhci-response-bits.c | ||
| unit-sectorflags.c | ||
| unit-sign-encrypted-output.c | ||
| unit-sign-encrypted-output.mkfrag | ||
| unit-spi-flash.c | ||
| unit-store-sbrk.c | ||
| unit-string.c | ||
| unit-tpm-api-names.c | ||
| unit-tpm-blob.c | ||
| unit-tpm-check-rot-auth.c | ||
| unit-tpm-rsa-exp.c | ||
| unit-uart-flash.c | ||
| unit-update-disk.c | ||
| unit-update-flash.c | ||
| unit-update-ram-nofixed.c | ||
| unit-update-ram.c | ||
README.md
Unit Test Tools
This uses the "check" unit test framework for C.
You may need to run "apt install check", "yum install check" or "brew install check".
Building
Use make to build.
Expected output
$ ./unit-parser
Running suite(s): wolfBoot
Explicit end of options reached
This field is too large (bigger than the space available in the current header)
This field is too large and would overflow the image header
Illegal address (too high)
Illegal address (too high)
100%: Checks: 2, Failures: 0, Errors: 0