Fix not checking hashed data size

firmware/lib/vboot_common.c

 /* Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Common functions between firmware and kernel verified boot.
  * (Firmware portion)
  */
 
 
 #include "vboot_common.h"
@@ skipping 198 matching lines @@
 
     if (VerifySignatureInside(block, block->key_block_size, sig)) {
       VBDEBUG(("Key block hash off end of block\n"));
       return VBOOT_KEY_BLOCK_INVALID;
     }
     if (sig->sig_size != SHA512_DIGEST_SIZE) {
       VBDEBUG(("Wrong hash size for key block.\n"));
       return VBOOT_KEY_BLOCK_INVALID;
     }
 
+    /* Make sure advertised signature data sizes are sane. */
+    if (block->key_block_size < sig->data_size) {
+      VBDEBUG(("Signature calculated past end of the block\n"));
+      return VBOOT_KEY_BLOCK_INVALID;
+    }
+
     VBDEBUG(("Checking key block hash only...\n"));
     header_checksum = DigestBuf((const uint8_t*)block, sig->data_size,
                                 SHA512_DIGEST_ALGORITHM);
     rv = SafeMemcmp(header_checksum, GetSignatureDataC(sig),
                     SHA512_DIGEST_SIZE);
     Free(header_checksum);
     if (rv) {
       VBDEBUG(("Invalid key block hash.\n"));
       return VBOOT_KEY_BLOCK_HASH;
     }
@@ skipping 13 matching lines @@
     if (!rsa) {
       VBDEBUG(("Invalid public key\n"));
       return VBOOT_PUBLIC_KEY_INVALID;
     }
 
     /* Make sure advertised signature data sizes are sane. */
     if (block->key_block_size < sig->data_size) {
       VBDEBUG(("Signature calculated past end of the block\n"));
       return VBOOT_KEY_BLOCK_INVALID;
     }
+
     VBDEBUG(("Checking key block signature...\n"));
     rv = VerifyData((const uint8_t*)block, size, sig, rsa);
     RSAPublicKeyFree(rsa);
     if (rv) {
       VBDEBUG(("Invalid key block signature.\n"));
       return VBOOT_KEY_BLOCK_SIGNATURE;
     }
   }
 
   /* Verify we signed enough data */
@@ skipping 181 matching lines @@
       return VBOOT_SHARED_DATA_INVALID;
     header->kernel_subkey_data_size = src->key_size;
   }
 
   /* Copy the kernel sign key blob into the destination buffer */
   PublicKeyInit(kdest, (uint8_t*)header + header->kernel_subkey_data_offset,
                 header->kernel_subkey_data_size);
 
   return PublicKeyCopy(kdest, src);
 }