boot: bootutil: bound the hashed span to the image’s area

bootutil_img_hash() takes the header size, the image size and the protected TLV size from the image header and hashes that many bytes out of the slot without checking the total against the area it reads from. The size check in boot_check_header_valid() does not cover the same span: it deliberately leaves ih_protect_tlv_size out when the image is to be decompressed, and several callers of bootutil_img_validate(), such as the serial recovery and single slot loaders, never run that check at all. A malformed header can therefore describe up to 64KB more data than the slot holds, and the hash then reads past the end of the area, which on configurations that hash the mapped storage directly is an unchecked read straight out of the flash device. The accumulation is unchecked as well and can wrap a 32-bit size.

Add the three sizes up with boot_u32_safe_add() and reject an image whose span, including the sector offset used in swap using offset mode, does not fit in the area, before any of it is hashed. Bounding the read where the bytes are read rather than extending the header check leaves what that check accepts for a compressed image alone; those bytes are read out of the slot either way, so an image that fails the new check could not have validated anyway.

Assisted-by: Claude:opus-5 Signed-off-by: David Brown david.brown@linaro.org

MCUboot

This is MCUboot version 2.4.0

MCUboot is a secure bootloader for 32-bits microcontrollers. It defines a common infrastructure for the bootloader and the system flash layout on microcontroller systems, and provides a secure bootloader that enables easy software upgrade.

MCUboot is not dependent on any specific operating system and hardware and relies on hardware porting layers from the operating system it works with. Currently, MCUboot works with the following operating systems and SoCs:

RIOT is supported only as a boot target. We will accept any new port contributed by the community once it is good enough.

MCUboot How-tos

See the following pages for instructions on using MCUboot with different operating systems and SoCs:

There are also instructions for the Simulator.

Roadmap

The issues being planned and worked on are tracked using GitHub issues. To give your input, visit MCUboot GitHub Issues.

Source files

You can find additional documentation on the bootloader in the source files. For more information, use the following links:

boot/bootutil - The core of the bootloader itself.
boot/boot_serial - Support for serial upgrade within the bootloader itself.
boot/zephyr - Port of the bootloader to Zephyr.
boot/mynewt - Bootloader application for Apache Mynewt.
boot/nuttx - Bootloader application and port of MCUboot interfaces for Apache NuttX.
boot/mbed - Port of the bootloader to Mbed OS.
boot/espressif - Bootloader application and MCUboot port for Espressif SoCs.
boot/cypress - Bootloader application and MCUboot port for Cypress/Infineon SoCs.
imgtool - A tool to securely sign firmware images for booting by MCUboot.
sim - A bootloader simulator for testing and regression.

Joining the project

Developers are welcome!

Use the following links to join or see more about the project: