Fixed VerifyFirmwarePreamble to check for a valid signing algorithm

vboot_firmware/lib/firmware_image_fw.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Functions for verifying a verified boot firmware image.
  * (Firmware Portion)
  */
 
 #include "firmware_image_fw.h"
 
@@ skipping 93 matching lines @@
   uint64_t len;
   int preamble_len;
   uint16_t firmware_version;
   uint16_t kernel_subkey_sign_algorithm;
 
   Memcpy(&firmware_version, preamble_blob, sizeof(firmware_version));
   Memcpy(&kernel_subkey_sign_algorithm,
          preamble_blob + (FIELD_LEN(firmware_version) +
                           FIELD_LEN(firmware_len)),
          FIELD_LEN(kernel_subkey_sign_algorithm));
+
+  if (kernel_subkey_sign_algorithm >= kNumAlgorithms)
+    return VERIFY_FIRMWARE_INVALID_ALGORITHM;
+
   preamble_len = GetFirmwarePreambleLen(kernel_subkey_sign_algorithm);
   if (!RSAVerifyBinary_f(NULL, firmware_sign_key,  /* Key to use */
                          preamble_blob,  /* Data to verify */
                          preamble_len,  /* Length of data */
                          preamble_blob + preamble_len,  /* Expected Signature */
                          firmware_sign_algorithm))
     return VERIFY_FIRMWARE_PREAMBLE_SIGNATURE_FAILED;
 
   Memcpy(&len, preamble_blob + FIELD_LEN(firmware_version),
          sizeof(len));
   *firmware_len = len;
   return 0;
 }
 
 int VerifyFirmwareData(RSAPublicKey* firmware_sign_key,
                        const uint8_t* preamble_start,
                        const uint8_t* firmware_data,
                        uint64_t firmware_len,
                        int firmware_sign_algorithm) {
   int signature_len = siglen_map[firmware_sign_algorithm];
   int preamble_len;
   uint16_t kernel_subkey_sign_algorithm;
   uint8_t* digest = NULL;
   const uint8_t* firmware_signature = NULL;
   DigestContext ctx;
   Memcpy(&kernel_subkey_sign_algorithm,
          preamble_start + (FIELD_LEN(firmware_version) +
                           FIELD_LEN(firmware_len)),
          FIELD_LEN(kernel_subkey_sign_algorithm));
+
+  if (kernel_subkey_sign_algorithm >= kNumAlgorithms)
+    return VERIFY_FIRMWARE_INVALID_ALGORITHM;
+
   preamble_len = GetFirmwarePreambleLen(kernel_subkey_sign_algorithm);
 
-
   /* Since the firmware signature is over the preamble and the firmware data,
    * which does not form a contiguous region of memory, we calculate the
    * message digest ourselves. */
   DigestInit(&ctx, firmware_sign_algorithm);
   DigestUpdate(&ctx, preamble_start, preamble_len);
   DigestUpdate(&ctx, firmware_data, firmware_len);
   digest = DigestFinal(&ctx);
   /* Firmware signature is at the end of preamble and preamble signature. */
   firmware_signature = preamble_start + preamble_len + signature_len;
   if (!RSAVerifyBinaryWithDigest_f(
@@ skipping 183 matching lines @@
      */
     if (stored_lversion <= firmwareB_lversion &&
         (VERIFY_FIRMWARE_SUCCESS == VerifyFirmware(root_key_blob,
                                                    verification_headerB,
                                                    firmwareB)))
         return BOOT_FIRMWARE_B_CONTINUE;
   }
   /* D'oh: No bootable firmware. */
   return BOOT_FIRMWARE_RECOVERY_CONTINUE;
 }