From 5e742637623af0b1ea365b4c8ffda566a0ee3a2b Mon Sep 17 00:00:00 2001 From: Sascha Hauer Date: Sun, 2 Dec 2012 11:38:49 +0100 Subject: [PATCH] filetype: Pass bufsize Pass the buffer size to the file detection code. This makes sure we do not read past the buffer. This is especially useful for ext filesystem detection as the magic is at byte offset 1080. Also introduce a FILE_TYPE_SAFE_BUFSIZE define which is set to the minimum bufsize the detection code needs to detect all known filetypes. Signed-off-by: Sascha Hauer --- arch/arm/lib/bootm.c | 2 +- arch/arm/mach-imx/imx-bbu-internal.c | 4 +-- commands/bootm.c | 2 +- common/filetype.c | 39 +++++++++++++++++++--------- common/uimage.c | 2 +- include/filetype.h | 4 ++- lib/gui/image_renderer.c | 6 ++--- lib/uncompress.c | 4 +-- 8 files changed, 40 insertions(+), 23 deletions(-) diff --git a/arch/arm/lib/bootm.c b/arch/arm/lib/bootm.c index 288c0b24a..51ac9af60 100644 --- a/arch/arm/lib/bootm.c +++ b/arch/arm/lib/bootm.c @@ -143,7 +143,7 @@ static int do_bootz_linux_fdt(int fd, struct image_data *data) if (ret < sizeof(*header)) return ret; - if (file_detect_type(header) != filetype_oftree) + if (file_detect_type(header, sizeof(*header)) != filetype_oftree) return -ENXIO; end = be32_to_cpu(header->totalsize); diff --git a/arch/arm/mach-imx/imx-bbu-internal.c b/arch/arm/mach-imx/imx-bbu-internal.c index c34f86f33..881c20ae9 100644 --- a/arch/arm/mach-imx/imx-bbu-internal.c +++ b/arch/arm/mach-imx/imx-bbu-internal.c @@ -110,7 +110,7 @@ static int imx_bbu_internal_v1_update(struct bbu_handler *handler, struct bbu_da int ret, image_len; void *buf; - if (file_detect_type(data->image) != filetype_arm_barebox) { + if (file_detect_type(data->image, data->len) != filetype_arm_barebox) { if (!bbu_force(data, "Not an ARM barebox image")) return -EINVAL; } @@ -332,7 +332,7 @@ static int imx_bbu_internal_v2_update(struct bbu_handler *handler, struct bbu_da int ret, image_len; void *buf; - if (file_detect_type(data->image) != filetype_arm_barebox) { + if (file_detect_type(data->image, data->len) != filetype_arm_barebox) { if (!bbu_force(data, "Not an ARM barebox image")) return -EINVAL; } diff --git a/commands/bootm.c b/commands/bootm.c index 98d2e4faf..483e6a193 100644 --- a/commands/bootm.c +++ b/commands/bootm.c @@ -184,7 +184,7 @@ static int bootm_open_oftree(struct image_data *data, const char *oftree, int nu } } - ft = file_detect_type(fdt); + ft = file_detect_type(fdt, size); if (ft != filetype_oftree) { printf("%s is not an oftree but %s\n", oftree, file_type_to_string(ft)); diff --git a/common/filetype.c b/common/filetype.c index b8d54f7fe..c1bd11db8 100644 --- a/common/filetype.c +++ b/common/filetype.c @@ -105,19 +105,24 @@ enum filetype is_fat_or_mbr(const unsigned char *sector, unsigned long *bootsec) return filetype_mbr; } -enum filetype file_detect_type(void *_buf) +enum filetype file_detect_type(void *_buf, size_t bufsize) { u32 *buf = _buf; u64 *buf64 = _buf; u8 *buf8 = _buf; enum filetype type; + if (bufsize < 9) + return filetype_unknown; + if (strncmp(buf8, "#!/bin/sh", 9) == 0) return filetype_sh; - if (is_barebox_arm_head(_buf)) - return filetype_arm_barebox; - if (buf[9] == 0x016f2818 || buf[9] == 0x18286f01) - return filetype_arm_zimage; + + if (bufsize < 32) + return filetype_unknown; + + if (strncmp(buf8, "BM", 2) == 0) + return filetype_bmp; if (buf8[0] == 0x89 && buf8[1] == 0x4c && buf8[2] == 0x5a && buf8[3] == 0x4f) return filetype_lzo_compressed; @@ -136,15 +141,25 @@ enum filetype file_detect_type(void *_buf) return filetype_oftree; if (strncmp(buf8, "ANDROID!", 8) == 0) return filetype_aimage; + if (buf64[0] == le64_to_cpu(0x0a1a0a0d474e5089ull)) + return filetype_png; if (strncmp(buf8 + 0x10, "barebox", 7) == 0) return filetype_mips_barebox; + + if (bufsize < 64) + return filetype_unknown; + + if (is_barebox_arm_head(_buf)) + return filetype_arm_barebox; + if (buf[9] == 0x016f2818 || buf[9] == 0x18286f01) + return filetype_arm_zimage; + + if (bufsize < 512) + return filetype_unknown; + type = is_fat_or_mbr(buf8, NULL); if (type != filetype_unknown) return type; - if (strncmp(buf8, "BM", 2) == 0) - return filetype_bmp; - if (buf64[0] == le64_to_cpu(0x0a1a0a0d474e5089ull)) - return filetype_png; return filetype_unknown; } @@ -160,13 +175,13 @@ enum filetype file_name_detect_type(const char *filename) if (fd < 0) return fd; - buf = xzalloc(512); + buf = xzalloc(FILE_TYPE_SAFE_BUFSIZE); - ret = read(fd, buf, 512); + ret = read(fd, buf, FILE_TYPE_SAFE_BUFSIZE); if (ret < 0) goto err_out; - type = file_detect_type(buf); + type = file_detect_type(buf, ret); if (type == filetype_mbr) { /* diff --git a/common/uimage.c b/common/uimage.c index 3f5a3d5cd..3bec6b39f 100644 --- a/common/uimage.c +++ b/common/uimage.c @@ -516,7 +516,7 @@ void *uimage_load_to_buf(struct uimage_handle *handle, int image_no, if (ret < 0) return NULL; - ft = file_detect_type(ftbuf); + ft = file_detect_type(ftbuf, 128); if ((int)ft < 0) return NULL; diff --git a/include/filetype.h b/include/filetype.h index 0a722a0a5..5fac53153 100644 --- a/include/filetype.h +++ b/include/filetype.h @@ -25,9 +25,11 @@ enum filetype { filetype_max, }; +#define FILE_TYPE_SAFE_BUFSIZE 2048 + const char *file_type_to_string(enum filetype f); const char *file_type_to_short_string(enum filetype f); -enum filetype file_detect_type(void *_buf); +enum filetype file_detect_type(void *_buf, size_t bufsize); enum filetype file_name_detect_type(const char *filename); enum filetype is_fat_or_mbr(const unsigned char *sector, unsigned long *bootsec); diff --git a/lib/gui/image_renderer.c b/lib/gui/image_renderer.c index 41dc43b3c..78e5777cb 100644 --- a/lib/gui/image_renderer.c +++ b/lib/gui/image_renderer.c @@ -13,10 +13,10 @@ static LIST_HEAD(image_renderers); -static struct image_renderer *get_renderer(void* buf) +static struct image_renderer *get_renderer(void* buf, size_t bufsize) { struct image_renderer *ir; - enum filetype type = file_detect_type(buf); + enum filetype type = file_detect_type(buf, bufsize); list_for_each_entry(ir, &image_renderers, list) { if (ir->type == type) @@ -40,7 +40,7 @@ struct image *image_renderer_open(const char* file) return ERR_PTR(-ENOMEM); } - ir = get_renderer(data); + ir = get_renderer(data, size); if (!ir) { ret = -ENOENT; goto out; diff --git a/lib/uncompress.c b/lib/uncompress.c index 8e4d3a1d9..e0a69df9f 100644 --- a/lib/uncompress.c +++ b/lib/uncompress.c @@ -78,7 +78,7 @@ int uncompress(unsigned char *inbuf, int len, char *err; if (inbuf) { - ft = file_detect_type(inbuf); + ft = file_detect_type(inbuf, len); uncompress_buf = NULL; uncompress_size = 0; } else { @@ -93,7 +93,7 @@ int uncompress(unsigned char *inbuf, int len, if (ret < 0) goto err; - ft = file_detect_type(uncompress_buf); + ft = file_detect_type(uncompress_buf, 32); } switch (ft) {