VBoot Reference: 18 Exabytes ought to be enough for everybody

src/platform/vboot_reference/utils/firmware_image.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Functions for generating and manipulating a verified boot firmware image.
  */
 
 #include "firmware_image.h"
 
 #include <fcntl.h>
@@ skipping 48 matching lines @@
   FirmwareImage* image = FirmwareImageNew();
 
   if (!image)
     return NULL;
 
   firmware_buf = BufferFromFile(input_file, &file_size);
   image_len = file_size;
 
   st.remaining_len = image_len;
   st.remaining_buf = firmware_buf;
+  st.overrun = 0;
 
   /* Read and compare magic bytes. */
   StatefulMemcpy(&st, &image->magic, FIRMWARE_MAGIC_SIZE);
   if (SafeMemcmp(image->magic, FIRMWARE_MAGIC, FIRMWARE_MAGIC_SIZE)) {
     fprintf(stderr, "Wrong Firmware Magic.\n");
     Free(firmware_buf);
     return NULL;
   }
   StatefulMemcpy(&st, &image->header_len, FIELD_LEN(header_len));
   StatefulMemcpy(&st, &image->firmware_sign_algorithm,
@@ skipping 46 matching lines @@
   /* Read firmware preamble signature. */
   image->preamble_signature = (uint8_t*) Malloc(signature_len);
   StatefulMemcpy(&st, image->preamble_signature, signature_len);
 
   image->firmware_signature = (uint8_t*) Malloc(signature_len);
   StatefulMemcpy(&st, image->firmware_signature, signature_len);
 
   image->firmware_data = (uint8_t*) Malloc(image->firmware_len);
   StatefulMemcpy(&st, image->firmware_data, image->firmware_len);
 
-  if(st.remaining_len != 0) {  /* Overrun or underrun. */
+  if(st.overrun || st.remaining_len != 0) {  /* Overrun or underrun. */
     Free(firmware_buf);
     return NULL;
   }
 
   Free(firmware_buf);
   return image;
 }
 
 int GetFirmwareHeaderLen(const FirmwareImage* image) {
   return (FIELD_LEN(header_len) + FIELD_LEN(firmware_sign_algorithm) +
@@ skipping 21 matching lines @@
 }
 
 
 uint8_t* GetFirmwareHeaderBlob(const FirmwareImage* image) {
   uint8_t* header_blob = NULL;
   MemcpyState st;
 
   header_blob = (uint8_t*) Malloc(GetFirmwareHeaderLen(image));
   st.remaining_len = GetFirmwareHeaderLen(image);
   st.remaining_buf = header_blob;
+  st.overrun = 0;
 
   StatefulMemcpy_r(&st, &image->header_len, FIELD_LEN(header_len));
   StatefulMemcpy_r(&st, &image->firmware_sign_algorithm, FIELD_LEN(header_len));
   StatefulMemcpy_r(&st, &image->firmware_key_version,
                  FIELD_LEN(firmware_key_version));
   StatefulMemcpy_r(&st, image->firmware_sign_key,
                  RSAProcessedKeySize(image->firmware_sign_algorithm));
   StatefulMemcpy_r(&st, &image->header_checksum, FIELD_LEN(header_checksum));
 
-  if (st.remaining_len != 0) {  /* Underrun or Overrun. */
+  if (st.overrun || st.remaining_len != 0) {  /* Underrun or Overrun. */
     Free(header_blob);
     return NULL;
   }
   return header_blob;
 }
 
 int GetFirmwarePreambleLen(void) {
   return (FIELD_LEN(firmware_version) + FIELD_LEN(firmware_len) +
           FIELD_LEN(preamble));
 }
 
 uint8_t* GetFirmwarePreambleBlob(const FirmwareImage* image) {
   uint8_t* preamble_blob = NULL;
   MemcpyState st;
 
   preamble_blob = (uint8_t*) Malloc(GetFirmwarePreambleLen());
   st.remaining_len = GetFirmwarePreambleLen();
   st.remaining_buf = preamble_blob;
+  st.overrun = 0;
 
   StatefulMemcpy_r(&st, &image->firmware_version, FIELD_LEN(firmware_version));
   StatefulMemcpy_r(&st, &image->firmware_len, FIELD_LEN(firmware_len));
   StatefulMemcpy_r(&st, image->preamble, FIELD_LEN(preamble));
 
-  if (st.remaining_len != 0 ) {  /* Underrun or Overrun. */
+  if (st.overrun || st.remaining_len != 0 ) {  /* Underrun or Overrun. */
     Free(preamble_blob);
     return NULL;
   }
   return preamble_blob;
 }
 
 
 uint8_t* GetFirmwareBlob(const FirmwareImage* image, uint64_t* blob_len) {
   int firmware_signature_len;
   uint8_t* firmware_blob = NULL;
   uint8_t* header_blob = NULL;
   uint8_t* preamble_blob = NULL;
   MemcpyState st;
 
   if (!image)
     return NULL;
 
   firmware_signature_len = siglen_map[image->firmware_sign_algorithm];
   *blob_len = (FIELD_LEN(magic) +
                GetFirmwareHeaderLen(image) +
                FIELD_LEN(firmware_key_signature) +
                GetFirmwarePreambleLen() +
                2 * firmware_signature_len +
                image->firmware_len);
   firmware_blob = (uint8_t*) Malloc(*blob_len);
   st.remaining_len = *blob_len;
   st.remaining_buf = firmware_blob;
+  st.overrun = 0;
 
   header_blob = GetFirmwareHeaderBlob(image);
   preamble_blob = GetFirmwarePreambleBlob(image);
 
   StatefulMemcpy_r(&st, image->magic, FIELD_LEN(magic));
   StatefulMemcpy_r(&st, header_blob, GetFirmwareHeaderLen(image));
   StatefulMemcpy_r(&st, image->firmware_key_signature,
                    FIELD_LEN(firmware_key_signature));
   StatefulMemcpy_r(&st, preamble_blob, GetFirmwarePreambleLen());
   StatefulMemcpy_r(&st, image->preamble_signature, firmware_signature_len);
   StatefulMemcpy_r(&st, image->firmware_signature, firmware_signature_len);
   StatefulMemcpy_r(&st, image->firmware_data, image->firmware_len);
 
   Free(preamble_blob);
   Free(header_blob);
 
-  if (st.remaining_len != 0) { /* Underrun or Overrun. */
+  if (st.overrun || st.remaining_len != 0) { /* Underrun or Overrun. */
     Free(firmware_blob);
     return NULL;
   }
   return firmware_blob;
 }
 
 int WriteFirmwareImage(const char* input_file,
                        const FirmwareImage* image) {
   int fd;
   uint8_t* firmware_blob;
@@ skipping 109 matching lines @@
                          *header_len, /* Length of data */
                          header_blob + *header_len,  /* Expected Signature */
                          ROOT_SIGNATURE_ALGORITHM))
     return VERIFY_FIRMWARE_ROOT_SIGNATURE_FAILED;
   return 0;
 }
 
 int VerifyFirmwarePreamble(RSAPublicKey* firmware_sign_key,
                            const uint8_t* preamble_blob,
                            int algorithm,
-                           int* firmware_len) {
-  uint32_t len;
+                           uint64_t* firmware_len) {
+  uint64_t len;
   int preamble_len;
   uint16_t firmware_version;
 
   Memcpy(&firmware_version, preamble_blob, sizeof(firmware_version));
 
   preamble_len = (FIELD_LEN(firmware_version) +
                   FIELD_LEN(firmware_len) +
                   FIELD_LEN(preamble));
   if (!RSAVerifyBinary_f(NULL, firmware_sign_key,  /* Key to use */
                          preamble_blob,  /* Data to verify */
                          preamble_len,  /* Length of data */
                          preamble_blob + preamble_len,  /* Expected Signature */
                          algorithm))
     return VERIFY_FIRMWARE_PREAMBLE_SIGNATURE_FAILED;
 
   Memcpy(&len, preamble_blob + FIELD_LEN(firmware_version),
          sizeof(len));
-  *firmware_len = (int) len;
+  *firmware_len = len;
   return 0;
 }
 
 int VerifyFirmwareData(RSAPublicKey* firmware_sign_key,
                        const uint8_t* preamble_start,
                        const uint8_t* firmware_data_start,
-                       int firmware_len,
+                       uint64_t firmware_len,
                        int algorithm) {
   int signature_len = siglen_map[algorithm];
   uint8_t* digest;
   DigestContext ctx;
 
   /* Since the firmware signature is over the preamble and the firmware data,
    * which does not form a contiguous region of memory, we calculate the
    * message digest ourselves. */
   DigestInit(&ctx, algorithm);
   DigestUpdate(&ctx, preamble_start, GetFirmwarePreambleLen());
   DigestUpdate(&ctx, firmware_data_start + signature_len, firmware_len);
   digest = DigestFinal(&ctx);
   if (!RSAVerifyBinaryWithDigest_f(
           NULL, firmware_sign_key,  /* Key to use. */
           digest,  /* Digest of the data to verify. */
           firmware_data_start,  /* Expected Signature */
           algorithm)) {
     Free(digest);
     return VERIFY_FIRMWARE_SIGNATURE_FAILED;
   }
   Free(digest);
   return 0;
 }
 
 int VerifyFirmware(const uint8_t* root_key_blob,
                    const uint8_t* firmware_blob) {
   int error_code = 0;
   int algorithm;  /* Signing key algorithm. */
   RSAPublicKey* firmware_sign_key = NULL;
-  int firmware_sign_key_len, signature_len, header_len, firmware_len;
+  int firmware_sign_key_len, signature_len, header_len;
+  uint64_t firmware_len;
   const uint8_t* header_ptr = NULL;  /* Pointer to header. */
   const uint8_t* firmware_sign_key_ptr = NULL;  /* Pointer to signing key. */
   const uint8_t* preamble_ptr = NULL;  /* Pointer to preamble block. */
   const uint8_t* firmware_ptr = NULL;  /* Pointer to firmware signature/data. */
 
   /* Note: All the offset calculations are based on struct FirmwareImage which
    * is defined in include/firmware_image.h. */
 
   /* Compare magic bytes. */
   if (SafeMemcmp(firmware_blob, FIRMWARE_MAGIC, FIRMWARE_MAGIC_SIZE))
@@ skipping 15 matching lines @@
                                           firmware_sign_key_len);
   signature_len = siglen_map[algorithm];
 
   /* Only continue if preamble verification succeeds. */
   preamble_ptr = (header_ptr + header_len +
                   FIELD_LEN(firmware_key_signature));
   if ((error_code = VerifyFirmwarePreamble(firmware_sign_key, preamble_ptr,
                                            algorithm,
                                            &firmware_len))) {
     RSAPublicKeyFree(firmware_sign_key);
+    fprintf(stderr, "Couldn't verify Firmware preamble.\n");
     return error_code;  /* AKA jump to recovery. */
   }
   /* Only continue if firmware data verification succeeds. */
   firmware_ptr = (preamble_ptr +
                   GetFirmwarePreambleLen() +
                   signature_len);
 
   if ((error_code = VerifyFirmwareData(firmware_sign_key, preamble_ptr,
                                        firmware_ptr,
                                        firmware_len,
                                        algorithm))) {
     RSAPublicKeyFree(firmware_sign_key);
+    fprintf(stderr, "Couldn't verify Firmware data.\n");
     return error_code;  /* AKA jump to recovery. */
   }
 
   RSAPublicKeyFree(firmware_sign_key);
   return 0;  /* Success! */
 }
 
 int VerifyFirmwareImage(const RSAPublicKey* root_key,
                         const FirmwareImage* image) {
   RSAPublicKey* firmware_sign_key = NULL;
@@ skipping 34 matching lines @@
                  FIELD_LEN(firmware_key_signature),
                  ROOT_SIGNATURE_ALGORITHM,
                  header_digest)) {
     error_code =  VERIFY_FIRMWARE_ROOT_SIGNATURE_FAILED;
     goto verify_failure;
   }
 
   /* Get sign key to verify the rest of the firmware. */
   firmware_sign_key_size = RSAProcessedKeySize(image->firmware_sign_algorithm);
   firmware_sign_key = RSAPublicKeyFromBuf(image->firmware_sign_key,
-                                 firmware_sign_key_size);
+                                          firmware_sign_key_size);
   signature_size = siglen_map[image->firmware_sign_algorithm];
 
   if (image->firmware_sign_algorithm >= kNumAlgorithms)
     return VERIFY_FIRMWARE_INVALID_ALGORITHM;
 
   /* Verify firmware preamble signature. */
   DigestInit(&ctx, image->firmware_sign_algorithm);
   DigestUpdate(&ctx, (uint8_t*) &image->firmware_version,
                FIELD_LEN(firmware_version));
   DigestUpdate(&ctx, (uint8_t*) &image->firmware_len,
                FIELD_LEN(firmware_len));
   DigestUpdate(&ctx, (uint8_t*) &image->preamble,
                FIELD_LEN(preamble));
   preamble_digest = DigestFinal(&ctx);
   if (!RSAVerify(firmware_sign_key, image->preamble_signature,
-                  signature_size, image->firmware_sign_algorithm,
-                  preamble_digest)) {
+                 signature_size, image->firmware_sign_algorithm,
+                 preamble_digest)) {
     error_code = VERIFY_FIRMWARE_PREAMBLE_SIGNATURE_FAILED;
     goto verify_failure;
   }
 
   /* Verify firmware signature - firmware signature is on the contents
    of firmware preamble + firmware_data. */
   DigestInit(&firmware_ctx, image->firmware_sign_algorithm);
   DigestUpdate(&firmware_ctx, (uint8_t*) &image->firmware_version,
                FIELD_LEN(firmware_version));
   DigestUpdate(&firmware_ctx, (uint8_t*) &image->firmware_len,
@@ skipping 189 matching lines @@
      * attempted.
      * If FirmwareB is not a rollback, then we attempt to do the verification.
      */
     if (stored_lversion <= firmwareB_lversion &&
         (VERIFY_FIRMWARE_SUCCESS == VerifyFirmware(root_key_blob, firmwareB)))
         return BOOT_FIRMWARE_B_CONTINUE;
   }
   /* D'oh: No bootable firmware. */
   return BOOT_FIRMWARE_RECOVERY_CONTINUE;
 }