[PATCH 2/4] boot: image-fit: add overflow guard for FIT decompression buffer

[Sriram Sriram <sriramsriram@linux.microsoft.com>]

From: Drew Kluemke <ankluemk@microsoft.com>

Add an overflow check before the 'len * 20' multiplication used to
compute the maximum decompression buffer size. On platforms where len
exceeds ULONG_MAX / 20 the multiplication wraps to a small value,
leading malloc to allocate a tiny buffer while decompression writes the
full stream -- a heap buffer overflow.

Guard against this by returning -ENOEXEC when len exceeds the safe
threshold.

Signed-off-by: Drew Kluemke <ankluemk@microsoft.com>
Signed-off-by: Sriram Sriram <sriramsriram@linux.microsoft.com>
---
 boot/image-fit.c | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/boot/image-fit.c b/boot/image-fit.c
index 26e9323da06..9770435f939 100644
--- a/boot/image-fit.c
+++ b/boot/image-fit.c
@@ -2355,9 +2355,17 @@ int fit_image_load(struct bootm_headers *images, ulong addr,
 	    !(image_type == IH_TYPE_KERNEL ||
 	      image_type == IH_TYPE_KERNEL_NOLOAD ||
 	      image_type == IH_TYPE_RAMDISK)) {
-		ulong max_decomp_len = len * 20;
+		ulong max_decomp_len;
 
 		log_debug("decompressing image\n");
+
+		if (len > ULONG_MAX / 20) {
+			printf("Error: %s image too large for decompression (0x%lx)\n",
+			       prop_name, len);
+			return -ENOEXEC;
+		}
+		max_decomp_len = len * 20;
+
 		if (load == data) {
 			loadbuf = aligned_alloc(8, max_decomp_len);
 			load = map_to_sysmem(loadbuf);
-- 
2.49.0