(mynewt-mcumgr) 14/14: cmd/img_mgmt: Add image size and offset checks

[ja...@apache.org]

This is an automated email from the ASF dual-hosted git repository.

sjanc pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/mynewt-mcumgr.git

commit e706d21bbc80fe3da7210978e02b0babeb89f47d
Author: Szymon Janc <sz...@codecoup.pl>
AuthorDate: Wed Oct 7 16:12:29 2026 +0200

    cmd/img_mgmt: Add image size and offset checks
    
    Check that uploaded image size fits in destination slot and that
    uploaded chunk does not extend past image size. Also check for
    overflow when calculating TLV offsets from image header.
    
    Assisted-by: Claude:claude-opus-5-5
---
 cmd/img_mgmt/port/mynewt/src/mynewt_img_mgmt.c | 18 ++++++++++++++++++
 cmd/img_mgmt/src/img_mgmt.c                    |  6 ++++++
 2 files changed, 24 insertions(+)

diff --git a/cmd/img_mgmt/port/mynewt/src/mynewt_img_mgmt.c b/cmd/img_mgmt/port/mynewt/src/mynewt_img_mgmt.c
index 9698193..5be1dfb 100644
--- a/cmd/img_mgmt/port/mynewt/src/mynewt_img_mgmt.c
+++ b/cmd/img_mgmt/port/mynewt/src/mynewt_img_mgmt.c
@@ -185,6 +185,19 @@ img_mgmt_impl_upload_inspect(const struct img_mgmt_upload_req *req,
             return MGMT_ERR_ENOMEM;
         }
 
+        /* Image must fit in slot */
+        rc = flash_area_open(action->area_id, &fa);
+        if (rc) {
+            *errstr = img_mgmt_err_str_flash_open_failed;
+            return MGMT_ERR_EUNKNOWN;
+        }
+        if (action->size > fa->fa_size) {
+            flash_area_close(fa);
+            *errstr = img_mgmt_err_str_no_slot;
+            return MGMT_ERR_EINVAL;
+        }
+        flash_area_close(fa);
+
         if (req->upgrade) {
             /* User specified upgrade-only.  Make sure new image version is
              * greater than that of the currently running image.
@@ -231,6 +244,11 @@ img_mgmt_impl_upload_inspect(const struct img_mgmt_upload_req *req,
         }
     }
 
+    /* Chunk must not extend past image size */
+    if (req->off + req->data_len > action->size) {
+        return MGMT_ERR_EINVAL;
+    }
+
     /* Calculate size of flash write. */
     action->write_bytes = req->data_len;
     if (req->off + req->data_len < action->size) {
diff --git a/cmd/img_mgmt/src/img_mgmt.c b/cmd/img_mgmt/src/img_mgmt.c
index 65ae992..b9b61a2 100644
--- a/cmd/img_mgmt/src/img_mgmt.c
+++ b/cmd/img_mgmt/src/img_mgmt.c
@@ -98,6 +98,9 @@ img_mgmt_find_tlvs(int slot, size_t *start_off, size_t *end_off,
 
     *start_off += sizeof tlv_info;
     *end_off = *start_off + tlv_info.it_tlv_tot;
+    if (*end_off < *start_off) {
+        return MGMT_ERR_EUNKNOWN;
+    }
 
     return 0;
 }
@@ -178,6 +181,9 @@ img_mgmt_read_info(int image_slot, struct image_version *ver, uint8_t *hash,
      * is considered invalid.
      */
     data_off = hdr.ih_hdr_size + hdr.ih_img_size;
+    if (data_off < hdr.ih_img_size) {
+        return MGMT_ERR_EUNKNOWN;
+    }
 
     rc = img_mgmt_find_tlvs(image_slot, &data_off, &data_end, IMAGE_TLV_PROT_INFO_MAGIC);
     if (!rc) {