Fix preamble range checks

firmware/lib/vboot_common.c

 /* Copyright (c) 2011 The Chromium OS Authors. All rights reserved.
  * Use of this source code is governed by a BSD-style license that can be
  * found in the LICENSE file.
  *
  * Common functions between firmware and kernel verified boot.
  * (Firmware portion)
  */
 
 
 #include "vboot_common.h"
@@ skipping 315 matching lines @@
     VBDEBUG(("Preamble signature validation failed\n"));
     return VBOOT_PREAMBLE_SIGNATURE;
   }
 
   /* Verify we signed enough data */
   if (sig->data_size < sizeof(VbFirmwarePreambleHeader)) {
     VBDEBUG(("Didn't sign enough data\n"));
     return VBOOT_PREAMBLE_INVALID;
   }
 
-  /* Verify body signature is inside the block */
-  if (VerifySignatureInside(preamble, preamble->preamble_size,
+  /* Verify body signature is inside the signed data */
+  if (VerifySignatureInside(preamble, sig->data_size,
                             &preamble->body_signature)) {
     VBDEBUG(("Firmware body signature off end of preamble\n"));
     return VBOOT_PREAMBLE_INVALID;
   }
 
-  /* Verify kernel subkey is inside the block */
-  if (VerifyPublicKeyInside(preamble, preamble->preamble_size,
+  /* Verify kernel subkey is inside the signed data */
+  if (VerifyPublicKeyInside(preamble, sig->data_size,
                             &preamble->kernel_subkey)) {
     VBDEBUG(("Kernel subkey off end of preamble\n"));
     return VBOOT_PREAMBLE_INVALID;
   }
 
   /* Success */
   return VBOOT_SUCCESS;
 }
 
 
@@ skipping 25 matching lines @@
     VBDEBUG(("Preamble signature validation failed\n"));
     return VBOOT_PREAMBLE_SIGNATURE;
   }
 
   /* Verify we signed enough data */
   if (sig->data_size < sizeof(VbKernelPreambleHeader)) {
     VBDEBUG(("Didn't sign enough data\n"));
     return VBOOT_PREAMBLE_INVALID;
   }
 
-  /* Verify body signature is inside the block */
-  if (VerifySignatureInside(preamble, preamble->preamble_size,
+  /* Verify body signature is inside the signed data */
+  if (VerifySignatureInside(preamble, sig->data_size,
                             &preamble->body_signature)) {
     VBDEBUG(("Kernel body signature off end of preamble\n"));
     return VBOOT_PREAMBLE_INVALID;
   }
 
   /* Success */
   return VBOOT_SUCCESS;
 }
 
 
@@ skipping 60 matching lines @@
       return VBOOT_SHARED_DATA_INVALID;
     header->kernel_subkey_data_size = src->key_size;
   }
 
   /* Copy the kernel sign key blob into the destination buffer */
   PublicKeyInit(kdest, (uint8_t*)header + header->kernel_subkey_data_offset,
                 header->kernel_subkey_data_size);
 
   return PublicKeyCopy(kdest, src);
 }