vboot: Add FIT_SIGNATURE_MAX_SIZE protection

[u-boot] / common / image-sig.c

diff --git a/common/image-sig.c b/common/image-sig.c
index f65d883994be42e81b12e4f8c2921f90346e943f..8d2fd10db669e751c19ceeda8bf51d163da9609a 100644 (file)
--- a/common/image-sig.c
+++ b/common/image-sig.c
@@ -156,6 +156,11 @@ static int fit_image_setup_verify(struct image_sign_info *info,
 {
        char *algo_name;
 
+       if (fdt_totalsize(fit) > CONFIG_FIT_SIGNATURE_MAX_SIZE) {
+               *err_msgp = "Total size too large";
+               return 1;
+       }
+
        if (fit_image_hash_get_algo(fit, noffset, &algo_name)) {
                *err_msgp = "Can't get hash algo property";
                return -1;