Security fixes for LoadKernel()

firmware/lib/vboot_kernel.c

 /* Copyright (c) 2010 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Functions for loading a kernel from disk.
  * (Firmware portion)
  */
 
 #include "vboot_kernel.h"
 
@@ skipping 123 matching lines @@
       !params->kernel_buffer ||
       !params->kernel_buffer_size) {
     VBDEBUG(("LoadKernel() called with invalid params\n"));
     return LOAD_KERNEL_INVALID;
   }
 
   /* Initialization */
   kernel_subkey = (VbPublicKey*)params->header_sign_key_blob;
   blba = params->bytes_per_lba;
   kbuf_sectors = KBUF_SIZE / blba;
+  if (0 == kbuf_sectors) {
+    VBDEBUG(("LoadKernel() called with sector size > KBUF_SIZE\n"));
+    return LOAD_KERNEL_INVALID;
+  }
+
   is_dev = (BOOT_FLAG_DEVELOPER & params->boot_flags ? 1 : 0);
   is_rec = (BOOT_FLAG_RECOVERY & params->boot_flags ? 1 : 0);
   is_normal = (!is_dev && !is_rec);
 
   /* Clear output params in case we fail */
   params->partition_number = 0;
   params->bootloader_address = 0;
   params->bootloader_size = 0;
 
   /* Let the TPM know if we're in recovery mode */
@@ skipping 37 matching lines @@
       break;
 
     /* Loop over candidate kernel partitions */
     while (GPT_SUCCESS == GptNextKernelEntry(&gpt, &part_start, &part_size)) {
       VbKeyBlockHeader* key_block;
       VbKernelPreambleHeader* preamble;
       RSAPublicKey* data_key;
       uint64_t key_version;
       uint64_t combined_version;
       uint64_t body_offset;
+      uint64_t body_offset_sectors;
+      uint64_t body_sectors;
 
       VBDEBUG(("Found kernel entry at %" PRIu64 " size %" PRIu64 "\n",
               part_start, part_size));
 
       /* Found at least one kernel partition. */
       found_partitions++;
 
       /* Read the first part of the kernel partition  */
       if (part_size < kbuf_sectors)
         continue;
@@ skipping 81 matching lines @@
         continue;
       }
 
       /* Verify kernel body starts at a multiple of the sector size. */
       body_offset = key_block->key_block_size + preamble->preamble_size;
       if (0 != body_offset % blba) {
         VBDEBUG(("Kernel body not at multiple of sector size.\n"));
         RSAPublicKeyFree(data_key);
         continue;
       }
+      body_offset_sectors = body_offset / blba;
+
+      /* Verify kernel body fits in the buffer */
+      body_sectors = (preamble->body_signature.data_size + blba - 1) / blba;
+      if (body_sectors * blba > params->kernel_buffer_size) {
+        VBDEBUG(("Kernel body doesn't fit in memory.\n"));
+        RSAPublicKeyFree(data_key);
+        continue;
+      }
 
       /* Verify kernel body fits in the partition */
-      if (body_offset + preamble->body_signature.data_size >
-          part_size * blba) {
+      if (body_offset_sectors + body_sectors > part_size) {
         VBDEBUG(("Kernel body doesn't fit in partition.\n"));
         RSAPublicKeyFree(data_key);
         continue;
       }
 
       /* Read the kernel data */
-      if (0 != BootDeviceReadLBA(
-              part_start + (body_offset / blba),
-              (preamble->body_signature.data_size + blba - 1) / blba,
-              params->kernel_buffer)) {
+      if (0 != BootDeviceReadLBA(part_start + body_offset_sectors,
+                                 body_sectors,
+                                 params->kernel_buffer)) {
         VBDEBUG(("Unable to read kernel data.\n"));
         RSAPublicKeyFree(data_key);
         continue;
       }
 
       /* Verify kernel data */
       if (0 != VerifyData((const uint8_t*)params->kernel_buffer,
                           params->kernel_buffer_size,
                           &preamble->body_signature, data_key)) {
         VBDEBUG(("Kernel data verification failed.\n"));
@@ skipping 78 matching lines @@
     /* Success! */
     return LOAD_KERNEL_SUCCESS;
   }
 
   // Handle error cases
   if (found_partitions)
     return LOAD_KERNEL_INVALID;
   else
     return LOAD_KERNEL_NOT_FOUND;
 }