Add additional checks for size greater than header size.

firmware/lib/vboot_common.c

 /* Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Common functions between firmware and kernel verified boot.
  * (Firmware portion)
  */
 
 
 #include "vboot_common.h"
@@ skipping 160 matching lines @@
   return 0;
 }
 
 
 int KeyBlockVerify(const VbKeyBlockHeader* block, uint64_t size,
                    const VbPublicKey *key, int hash_only) {
 
   const VbSignature* sig;
 
   /* Sanity checks before attempting signature of data */
+  if(size < sizeof(VbKeyBlockHeader)) {
+    VBDEBUG(("Not enough space for key block header.\n"));
+    return VBOOT_KEY_BLOCK_INVALID;
+  }
   if (SafeMemcmp(block->magic, KEY_BLOCK_MAGIC, KEY_BLOCK_MAGIC_SIZE)) {
     VBDEBUG(("Not a valid verified boot key block.\n"));
     return VBOOT_KEY_BLOCK_INVALID;
   }
   if (block->header_version_major != KEY_BLOCK_HEADER_VERSION_MAJOR) {
     VBDEBUG(("Incompatible key block header version.\n"));
     return VBOOT_KEY_BLOCK_INVALID;
   }
   if (size < block->key_block_size) {
     VBDEBUG(("Not enough data for key block.\n"));
@@ skipping 94 matching lines @@
   return VBOOT_SUCCESS;
 }
 
 
 int VerifyFirmwarePreamble(const VbFirmwarePreambleHeader* preamble,
                            uint64_t size, const RSAPublicKey* key) {
 
   const VbSignature* sig = &preamble->preamble_signature;
 
   /* Sanity checks before attempting signature of data */
+  if(size < sizeof(VbFirmwarePreambleHeader)) {
+    VBDEBUG(("Not enough data for preamble header.\n"));
+    return VBOOT_PREAMBLE_INVALID;
+  }
   if (preamble->header_version_major !=
       FIRMWARE_PREAMBLE_HEADER_VERSION_MAJOR) {
     VBDEBUG(("Incompatible firmware preamble header version.\n"));
     return VBOOT_PREAMBLE_INVALID;
   }
   if (size < preamble->preamble_size) {
     VBDEBUG(("Not enough data for preamble.\n"));
     return VBOOT_PREAMBLE_INVALID;
   }
 
@@ skipping 38 matching lines @@
   return VBOOT_SUCCESS;
 }
 
 
 int VerifyKernelPreamble(const VbKernelPreambleHeader* preamble,
                          uint64_t size, const RSAPublicKey* key) {
 
   const VbSignature* sig = &preamble->preamble_signature;
 
   /* Sanity checks before attempting signature of data */
+  if(size < sizeof(VbKernelPreambleHeader)) {
+    VBDEBUG(("Not enough data for preamble header.\n"));
+    return VBOOT_PREAMBLE_INVALID;
+  }
   if (preamble->header_version_major != KERNEL_PREAMBLE_HEADER_VERSION_MAJOR) {
     VBDEBUG(("Incompatible kernel preamble header version.\n"));
     return VBOOT_PREAMBLE_INVALID;
   }
   if (size < preamble->preamble_size) {
     VBDEBUG(("Not enough data for preamble.\n"));
     return VBOOT_PREAMBLE_INVALID;
   }
 
   /* Check signature */
@@ skipping 87 matching lines @@
       return VBOOT_SHARED_DATA_INVALID;
     header->kernel_subkey_data_size = src->key_size;
   }
 
   /* Copy the kernel sign key blob into the destination buffer */
   PublicKeyInit(kdest, (uint8_t*)header + header->kernel_subkey_data_offset,
                 header->kernel_subkey_data_size);
 
   return PublicKeyCopy(kdest, src);
 }