mirror of
https://github.com/brain-hackers/u-boot-brain
synced 2024-09-15 01:03:24 +09:00
f1c85688ab
A specially crafted FIT image leads to memory corruption in the stack when using the verified boot feature. The function fit_config_check_sig has a logic error that makes it possible to write past the end of the stack allocated array node_inc. This could potentially be used to bypass the signature check when using verified boot. This change ensures that the number of strings is correct when counted. Signed-off-by: Konrad Beckmann <konrad.beckmann@gmail.com> Reviewed-by: Simon Glass <sjg@chromium.org> |
||
|---|---|---|
| .. | ||
| eeprom | ||
| init | ||
| spl | ||
| autoboot.c | ||
| avb_verify.c | ||
| bedbug.c | ||
| board_f.c | ||
| board_info.c | ||
| board_r.c | ||
| boot_fit.c | ||
| bootm_os.c | ||
| bootm.c | ||
| bootretry.c | ||
| bootstage.c | ||
| bouncebuf.c | ||
| cli_hush.c | ||
| cli_readline.c | ||
| cli_simple.c | ||
| cli.c | ||
| command.c | ||
| common_fit.c | ||
| console.c | ||
| cros_ec.c | ||
| ddr_spd.c | ||
| dfu.c | ||
| dlmalloc.c | ||
| dlmalloc.src | ||
| edid.c | ||
| exports.c | ||
| fdt_support.c | ||
| flash.c | ||
| hash.c | ||
| hwconfig.c | ||
| image-android-dt.c | ||
| image-android.c | ||
| image-fdt.c | ||
| image-fit.c | ||
| image-sig.c | ||
| image.c | ||
| iomux.c | ||
| iotrace.c | ||
| kallsyms.c | ||
| Kconfig | ||
| kgdb_stubs.c | ||
| kgdb.c | ||
| lcd_console_rotation.c | ||
| lcd_console.c | ||
| lcd_simplefb.c | ||
| lcd.c | ||
| log_console.c | ||
| log.c | ||
| lynxkdi.c | ||
| main.c | ||
| Makefile | ||
| malloc_simple.c | ||
| memsize.c | ||
| menu.c | ||
| miiphyutil.c | ||
| s_record.c | ||
| splash_source.c | ||
| splash.c | ||
| stdio.c | ||
| system_map.c | ||
| update.c | ||
| usb_hub.c | ||
| usb_kbd.c | ||
| usb_storage.c | ||
| usb.c | ||
| xyzModem.c | ||