Make sure advertised signature data size is sane.

firmware/lib/vboot_common.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Common functions between firmware and kernel verified boot.
  * (Firmware portion)
  */
 
 
 #include "vboot_common.h"
@@ skipping 177 matching lines @@
     if (VerifySignatureInside(block, block->key_block_size, sig)) {
       VBDEBUG(("Key block signature off end of block\n"));
       return VBOOT_KEY_BLOCK_INVALID;
     }
 
     rsa = PublicKeyToRSA(key);
     if (!rsa) {
       VBDEBUG(("Invalid public key\n"));
       return VBOOT_PUBLIC_KEY_INVALID;
     }
+
+    /* Make sure advertised signature data sizes are sane. */
+    if (block->key_block_size < sig->data_size) {
+      VBDEBUG(("Signature calculated past end of the block\n"));
+      return VBOOT_KEY_BLOCK_INVALID;
+    }
     rv = VerifyData((const uint8_t*)block, sig, rsa);
     RSAPublicKeyFree(rsa);
     if (rv)
       return VBOOT_KEY_BLOCK_SIGNATURE;
-
   } else {
     /* Check hash */
     uint8_t* header_checksum = NULL;
     int rv;
 
     sig = &block->key_block_checksum;
 
     if (VerifySignatureInside(block, block->key_block_size, sig)) {
       VBDEBUG(("Key block hash off end of block\n"));
       return VBOOT_KEY_BLOCK_INVALID;
@@ skipping 49 matching lines @@
   if (size < preamble->preamble_size) {
     VBDEBUG(("Not enough data for preamble.\n"));
     return VBOOT_PREAMBLE_INVALID;
   }
 
   /* Check signature */
   if (VerifySignatureInside(preamble, preamble->preamble_size, sig)) {
     VBDEBUG(("Preamble signature off end of preamble\n"));
     return VBOOT_PREAMBLE_INVALID;
   }
+
+  /* Make sure advertised signature data sizes are sane. */
+  if (preamble->preamble_size < sig->data_size) {
+    VBDEBUG(("Signature calculated past end of the block\n"));
+    return VBOOT_PREAMBLE_INVALID;
+  }
+
   if (VerifyData((const uint8_t*)preamble, sig, key)) {
     VBDEBUG(("Preamble signature validation failed\n"));
     return VBOOT_PREAMBLE_SIGNATURE;
   }
 
   /* Verify we signed enough data */
   if (sig->data_size < sizeof(VbFirmwarePreambleHeader)) {
     VBDEBUG(("Didn't sign enough data\n"));
     return VBOOT_PREAMBLE_INVALID;
   }
@@ skipping 51 matching lines @@
   /* Verify body signature is inside the block */
   if (VerifySignatureInside(preamble, preamble->preamble_size,
                             &preamble->body_signature)) {
     VBDEBUG(("Kernel body signature off end of preamble\n"));
     return VBOOT_PREAMBLE_INVALID;
   }
 
   /* Success */
   return VBOOT_SUCCESS;
 }