[PATCH 0/3] bootm: size the noload buffer from the compressor header

[Aristo Chen via U-Boot <u-boot@lists.u-boot-project.org>]

For a compressed kernel_noload image, bootm_load_os() currently sizes
the decompression buffer as ALIGN(image_len * 8, SZ_1M). The 8x
heuristic works for typical kernels, but any well-compressed payload
(e.g. a long run of zeros) can exceed it, and no fixed multiplier is
safe against arbitrarily compressible input.

This series reads the real uncompressed size from the compressor
header instead. A new helper image_decomp_get_uncompressed_size()
returns the size from gzip ISIZE, lzma's fixed 8-byte header field,
lz4's Content_Size (when the FLG bit is set), or zstd's
Frame_Content_Size. Where the format lacks a size (bzip2, lzo, xz) or
the specific stream omits it (lzma "unknown", lz4 without
--content-size), bootm falls back to the existing 8x heuristic. The
header-derived value is attacker-controlled, so it is capped at
CONFIG_SYS_BOOTM_LEN before use.

Patch 1 adds the helper and wires it into bootm_load_os().

Patch 2 covers gzip, lz4 (with --content-size), and zstd end-to-end
through bootm on sandbox. Every noload_decomp test now carries the
compressor in its name (test_fit_kernel_noload_decomp_<comp>_*); the
lz4 and zstd cases are guarded with requiredtool markers so they skip
cleanly on hosts that don't ship the corresponding compressor. The
lying-header case is exercised for gzip only, because the
CONFIG_SYS_BOOTM_LEN cap lives in one format-agnostic branch of
bootm_load_os() that every parser feeds into.

Patch 3 covers the lzma branch of the helper via a C-level unit test
with a hand-crafted static blob, because standard Ubuntu's xz-utils
lzma shim and Python's lzma.FORMAT_ALONE both write the header size
as "unknown".

Tested on sandbox; the five kernel_noload_decomp pytests pass, the
new compression_test_image_decomp_lzma unit test passes alongside the
14 existing compression unit tests, and each commit builds in
isolation.

Aristo Chen (3):
  bootm: size the noload decompression buffer from the compressor header
  test: fit: cover the kernel_noload header-size and lying-header paths
  test: lib: cover image_decomp_get_uncompressed_size() for lzma streams

 boot/bootm.c              |  20 +++--
 boot/image.c              |  79 +++++++++++++++++
 include/image.h           |  25 ++++++
 test/lib/compression.c    |  66 ++++++++++++++
 test/py/tests/test_fit.py | 182 +++++++++++++++++++++++++++++++++-----
 5 files changed, 346 insertions(+), 26 deletions(-)

-- 
2.43.0