This is an automated email from the ASF dual-hosted git repository. sjanc pushed a commit to branch master in repository https://gitbox.apache.org/repos/asf/mynewt-mcumgr.git
commit e706d21bbc80fe3da7210978e02b0babeb89f47d Author: Szymon Janc <[email protected]> AuthorDate: Wed Oct 7 16:12:29 2026 +0200 cmd/img_mgmt: Add image size and offset checks Check that uploaded image size fits in destination slot and that uploaded chunk does not extend past image size. Also check for overflow when calculating TLV offsets from image header. Assisted-by: Claude:claude-opus-5-5 --- cmd/img_mgmt/port/mynewt/src/mynewt_img_mgmt.c | 18 ++++++++++++++++++ cmd/img_mgmt/src/img_mgmt.c | 6 ++++++ 2 files changed, 24 insertions(+) diff --git a/cmd/img_mgmt/port/mynewt/src/mynewt_img_mgmt.c b/cmd/img_mgmt/port/mynewt/src/mynewt_img_mgmt.c index 9698193..5be1dfb 100644 --- a/cmd/img_mgmt/port/mynewt/src/mynewt_img_mgmt.c +++ b/cmd/img_mgmt/port/mynewt/src/mynewt_img_mgmt.c @@ -185,6 +185,19 @@ img_mgmt_impl_upload_inspect(const struct img_mgmt_upload_req *req, return MGMT_ERR_ENOMEM; } + /* Image must fit in slot */ + rc = flash_area_open(action->area_id, &fa); + if (rc) { + *errstr = img_mgmt_err_str_flash_open_failed; + return MGMT_ERR_EUNKNOWN; + } + if (action->size > fa->fa_size) { + flash_area_close(fa); + *errstr = img_mgmt_err_str_no_slot; + return MGMT_ERR_EINVAL; + } + flash_area_close(fa); + if (req->upgrade) { /* User specified upgrade-only. Make sure new image version is * greater than that of the currently running image. @@ -231,6 +244,11 @@ img_mgmt_impl_upload_inspect(const struct img_mgmt_upload_req *req, } } + /* Chunk must not extend past image size */ + if (req->off + req->data_len > action->size) { + return MGMT_ERR_EINVAL; + } + /* Calculate size of flash write. */ action->write_bytes = req->data_len; if (req->off + req->data_len < action->size) { diff --git a/cmd/img_mgmt/src/img_mgmt.c b/cmd/img_mgmt/src/img_mgmt.c index 65ae992..b9b61a2 100644 --- a/cmd/img_mgmt/src/img_mgmt.c +++ b/cmd/img_mgmt/src/img_mgmt.c @@ -98,6 +98,9 @@ img_mgmt_find_tlvs(int slot, size_t *start_off, size_t *end_off, *start_off += sizeof tlv_info; *end_off = *start_off + tlv_info.it_tlv_tot; + if (*end_off < *start_off) { + return MGMT_ERR_EUNKNOWN; + } return 0; } @@ -178,6 +181,9 @@ img_mgmt_read_info(int image_slot, struct image_version *ver, uint8_t *hash, * is considered invalid. */ data_off = hdr.ih_hdr_size + hdr.ih_img_size; + if (data_off < hdr.ih_img_size) { + return MGMT_ERR_EUNKNOWN; + } rc = img_mgmt_find_tlvs(image_slot, &data_off, &data_end, IMAGE_TLV_PROT_INFO_MAGIC); if (!rc) {
