[PATCH v1 0/3] fit: cipher: bounds checks on the ciphered image path

[PATCH v1 0/3] fit: cipher: bounds checks on the ciphered image path

[Pranav Rajendran]

Three fixes in the FIT cipher path, found while auditing for image-
controlled values used as buffer lengths without validation. They were
reported to the list earlier; these are the fixes.

Patch 1 is an out-of-bounds write. image_aes_decrypt() sizes its output
buffer with cipher_len but decrypts DIV_ROUND_UP(cipher_len, block)
blocks into it, so a 'data' length that is not block aligned writes past
the end of the allocation.

Patches 2 and 3 are the two halves of the unciphered size never being
checked: the 'data-size-unciphered' property is read without asking for
its length, and the value it yields is never related to the amount of
data that was actually decrypted. The second matters because that
property sits outside the per-image hash and signature, so it can be
changed on a signed FIT without disturbing verification.

I have kept them as separate patches since they are independent defects
with different consequences, but I am happy to squash 1 and 3 if you
would rather have one change per function.

checkpatch-clean, builds for sandbox (CONFIG_FIT_CIPHER=y) with no new
warnings at W=1, and no change in test/py results.

Pranav Rajendran (3):
  lib: aes: reject a ciphertext length that is not a whole number of
    blocks
  image-fit: check the length of the data-size-unciphered property
  lib: aes: reject an unciphered size larger than the ciphertext

 boot/image-fit.c      |  6 +++++-
 lib/aes/aes-decrypt.c | 21 ++++++++++++++++++++-
 2 files changed, 25 insertions(+), 2 deletions(-)

-- 
2.50.1 (Apple Git-155)

[PATCH v1 1/3] lib: aes: reject a ciphertext length that is not a whole number of blocks

[Pranav Rajendran]

image_aes_decrypt() allocates cipher_len bytes for the plaintext but
then asks aes_cbc_decrypt_blocks() to write
DIV_ROUND_UP(cipher_len, AES_BLOCK_LENGTH) blocks into it. For a
cipher_len that is not a multiple of AES_BLOCK_LENGTH the rounding up
adds one block, so the last block is written up to AES_BLOCK_LENGTH - 1
bytes past the end of the allocation, and read the same distance past
the end of the ciphertext.

cipher_len is the size of the image data in the FIT, so an image with a
'data' property whose length is not block aligned is enough to reach
this. The overflowing bytes are decryption output, i.e. they depend on
the key, but the length itself is not covered by anything that would
stop the image from being parsed this far.

A CBC ciphertext is a whole number of blocks by construction, so treat
anything else as a malformed image and reject it before allocating.
With that established, compute the block count with a plain division so
the buffer size and the write length cannot drift apart again.

Fixes: 4df3578119b0 ("u-boot: fit: add support to decrypt fit with aes")
Signed-off-by: Pranav Rajendran <pranavkasthuri@gmail.com>
---
 lib/aes/aes-decrypt.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/lib/aes/aes-decrypt.c b/lib/aes/aes-decrypt.c
index 741102a4723..85773a9c4f6 100644
--- a/lib/aes/aes-decrypt.c
+++ b/lib/aes/aes-decrypt.c
@@ -17,6 +17,16 @@ int image_aes_decrypt(struct image_cipher_info *info,
 	unsigned char key_exp[AES256_EXPAND_KEY_LENGTH];
 	unsigned int aes_blocks, key_len = info->cipher->key_len;
 
+	/*
+	 * The ciphertext is a whole number of AES blocks by construction, and
+	 * the decryption below writes one full block at a time, so anything
+	 * else would overflow the output buffer.
+	 */
+	if (!cipher_len || cipher_len % AES_BLOCK_LENGTH) {
+		printf("Invalid ciphertext length\n");
+		return -EINVAL;
+	}
+
 	*data = malloc(cipher_len);
 	if (!*data) {
 		printf("Can't allocate memory to decrypt\n");
@@ -30,7 +40,7 @@ int image_aes_decrypt(struct image_cipher_info *info,
 	aes_expand_key((u8 *)info->key, key_len, key_exp);
 
 	/* Calculate the number of AES blocks to encrypt. */
-	aes_blocks = DIV_ROUND_UP(cipher_len, AES_BLOCK_LENGTH);
+	aes_blocks = cipher_len / AES_BLOCK_LENGTH;
 
 	aes_cbc_decrypt_blocks(key_len, key_exp, (u8 *)info->iv,
 			       (u8 *)cipher, *data, aes_blocks);
-- 
2.50.1 (Apple Git-155)

Re: [PATCH v1 1/3] lib: aes: reject a ciphertext length that is not a whole number of blocks

[Simon Glass]

On 2026-08-15T22:07:52, Pranav Rajendran <pranavkasthuri@gmail.com> wrote:
> lib: aes: reject a ciphertext length that is not a whole number of blocks
>
> image_aes_decrypt() allocates cipher_len bytes for the plaintext but
> then asks aes_cbc_decrypt_blocks() to write
> DIV_ROUND_UP(cipher_len, AES_BLOCK_LENGTH) blocks into it. For a
> cipher_len that is not a multiple of AES_BLOCK_LENGTH the rounding up
> adds one block, so the last block is written up to AES_BLOCK_LENGTH - 1
> bytes past the end of the allocation, and read the same distance past
> the end of the ciphertext.
>
> cipher_len is the size of the image data in the FIT, so an image with a
> 'data' property whose length is not block aligned is enough to reach
> this. The overflowing bytes are decryption output, i.e. they depend on
> the key, but the length itself is not covered by anything that would
> stop the image from being parsed this far.
>
> A CBC ciphertext is a whole number of blocks by construction, so treat
> anything else as a malformed image and reject it before allocating.
> With that established, compute the block count with a plain division so
> the buffer size and the write length cannot drift apart again.
>
> Fixes: 4df3578119b0 ("u-boot: fit: add support to decrypt fit with aes")
> Signed-off-by: Pranav Rajendran <pranavkasthuri@gmail.com>
>
> lib/aes/aes-decrypt.c | 12 +++++++++++-
>  1 file changed, 11 insertions(+), 1 deletion(-)

Reviewed-by: Simon Glass <sjg@chromium.org>

[PATCH v1 2/3] image-fit: check the length of the data-size-unciphered property

[Pranav Rajendran]

fit_image_get_data_size_unciphered() passes NULL as fdt_getprop()'s
length argument, so it accepts a 'data-size-unciphered' property of any
size and then dereferences the first four bytes of it. A property
shorter than that is read past its end, and the bytes that follow it in
the FIT are returned to the caller as the unciphered size.

Ask for the length and require it to be exactly one fdt32_t, as the
binding describes.

Fixes: 4df3578119b0 ("u-boot: fit: add support to decrypt fit with aes")
Signed-off-by: Pranav Rajendran <pranavkasthuri@gmail.com>
---
 boot/image-fit.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/boot/image-fit.c b/boot/image-fit.c
index ef90c5abd18..0b98cc242e3 100644
--- a/boot/image-fit.c
+++ b/boot/image-fit.c
@@ -1040,11 +1040,15 @@ int fit_image_get_data_size_unciphered(const void *fit, int noffset,
 				       size_t *data_size)
 {
 	const fdt32_t *val;
+	int len;
 
-	val = fdt_getprop(fit, noffset, "data-size-unciphered", NULL);
+	val = fdt_getprop(fit, noffset, "data-size-unciphered", &len);
 	if (!val)
 		return -ENOENT;
 
+	if (len != sizeof(*val))
+		return -EINVAL;
+
 	*data_size = (size_t)fdt32_to_cpu(*val);
 
 	return 0;
-- 
2.50.1 (Apple Git-155)

Re: [PATCH v1 2/3] image-fit: check the length of the data-size-unciphered property

[Simon Glass]

Hi Pranav,

On 2026-08-15T22:07:52, Pranav Rajendran <pranavkasthuri@gmail.com> wrote:
> image-fit: check the length of the data-size-unciphered property
>
> fit_image_get_data_size_unciphered() passes NULL as fdt_getprop()'s
> length argument, so it accepts a 'data-size-unciphered' property of any
> size and then dereferences the first four bytes of it. A property
> shorter than that is read past its end, and the bytes that follow it in
> the FIT are returned to the caller as the unciphered size.
>
> Ask for the length and require it to be exactly one fdt32_t, as the
> binding describes.
>
> Fixes: 4df3578119b0 ("u-boot: fit: add support to decrypt fit with aes")
> Signed-off-by: Pranav Rajendran <pranavkasthuri@gmail.com>
>
> boot/image-fit.c | 6 +++++-
>  1 file changed, 5 insertions(+), 1 deletion(-)

> diff --git a/boot/image-fit.c b/boot/image-fit.c
> @@ -1040,11 +1040,15 @@ int fit_image_get_data_size_unciphered(const void *fit, int noffset,
>                                      size_t *data_size)
>  {
>       const fdt32_t *val;
> +     int len;
>
> -     val = fdt_getprop(fit, noffset, "data-size-unciphered", NULL);
> +     val = fdt_getprop(fit, noffset, "data-size-unciphered", &len);
>       if (!val)
>               return -ENOENT;
>
> +     if (len != sizeof(*val))
> +             return -EINVAL;
> +
>       *data_size = (size_t)fdt32_to_cpu(*val);

Please add -EINVAL to the kernel-doc block above so the contract
matches the code. Otherwise this looks right.

With that:

Reviewed-by: Simon Glass <sjg@chromium.org>

Regards,
Simon

[PATCH v1 3/3] lib: aes: reject an unciphered size larger than the ciphertext

[Pranav Rajendran]

image_aes_decrypt() allocates cipher_len bytes, decrypts into them, and
then reports the plaintext length to its caller as
info->size_unciphered, without relating the two. size_unciphered comes
from the image's 'data-size-unciphered' property, so an image can claim
a plaintext larger than the buffer that was allocated for it.

fit_image_uncipher() propagates that length as the image size, and
everything downstream - the load, the copy to the entry point - works
from it, reading up to 4 GiB past the end of the decrypted buffer.

Unlike the image data itself, 'data-size-unciphered' is not covered by
the per-image hash or signature, so this is reachable on a signed FIT
whose signature still verifies.

Decryption produces exactly cipher_len bytes, so require the claimed
size to fit within that.

Fixes: 4df3578119b0 ("u-boot: fit: add support to decrypt fit with aes")
Signed-off-by: Pranav Rajendran <pranavkasthuri@gmail.com>
---
 lib/aes/aes-decrypt.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/lib/aes/aes-decrypt.c b/lib/aes/aes-decrypt.c
index 85773a9c4f6..5d616983082 100644
--- a/lib/aes/aes-decrypt.c
+++ b/lib/aes/aes-decrypt.c
@@ -27,6 +27,15 @@ int image_aes_decrypt(struct image_cipher_info *info,
 		return -EINVAL;
 	}
 
+	/*
+	 * Decryption produces exactly cipher_len bytes, so the unciphered
+	 * size the image claims cannot be larger than that.
+	 */
+	if (info->size_unciphered > cipher_len) {
+		printf("Invalid unciphered size\n");
+		return -EINVAL;
+	}
+
 	*data = malloc(cipher_len);
 	if (!*data) {
 		printf("Can't allocate memory to decrypt\n");
-- 
2.50.1 (Apple Git-155)

Re: [PATCH v1 3/3] lib: aes: reject an unciphered size larger than the ciphertext

[Simon Glass]

On 2026-08-15T22:07:52, Pranav Rajendran <pranavkasthuri@gmail.com> wrote:
> lib: aes: reject an unciphered size larger than the ciphertext
>
> image_aes_decrypt() allocates cipher_len bytes, decrypts into them, and
> then reports the plaintext length to its caller as
> info->size_unciphered, without relating the two. size_unciphered comes
> from the image's 'data-size-unciphered' property, so an image can claim
> a plaintext larger than the buffer that was allocated for it.
>
> fit_image_uncipher() propagates that length as the image size, and
> everything downstream - the load, the copy to the entry point - works
> from it, reading up to 4 GiB past the end of the decrypted buffer.
>
> Unlike the image data itself, 'data-size-unciphered' is not covered by
> the per-image hash or signature, so this is reachable on a signed FIT
> whose signature still verifies.
>
> Decryption produces exactly cipher_len bytes, so require the claimed
> size to fit within that.
>
> Fixes: 4df3578119b0 ("u-boot: fit: add support to decrypt fit with aes")
> Signed-off-by: Pranav Rajendran <pranavkasthuri@gmail.com>
>
> lib/aes/aes-decrypt.c | 9 +++++++++
>  1 file changed, 9 insertions(+)

Reviewed-by: Simon Glass <sjg@chromium.org>

Re: [v1,0/3] fit: cipher: bounds checks on the ciphered image path

[Simon Glass]

Hi Pranav,

On 2026-08-15T22:07:52, Pranav Rajendran <pranavkasthuri@gmail.com> wrote:

> I have kept them as separate patches since they are independent defects
> with different consequences, but I am happy to squash 1 and 3 if you
> would rather have one change per function.

Please keep them separate - distinct Fixes: targets, and easier to
back-port independently.

Since these are security fixes, how about adding regression tests?
test/lib/test_aes.c covers the primitive, but nothing exercises
image_aes_decrypt() or fit_image_get_data_size_unciphered() against a
malformed FIT. A small sandbox test constructing a FIT with a
non-block-aligned 'data', a truncated 'data-size-unciphered', and an
oversized unciphered size would pin all three down. What do you think?

Regards,
Simon

[PATCH v2 0/5] fit: cipher: bounds checks on the ciphered image path

[Pranav Rajendran]

Changes in v2:
- Kept patches 1-3 as separate changes per Simon's request (distinct
  Fixes: targets, easier to back-port independently).
- Patch 2: documented the new -EINVAL return in the kernel-doc block,
  per Simon's review comment.
- Added patch 5: a fit_cipher sandbox test suite covering all three
  defects (non-block-aligned 'data', a truncated
  'data-size-unciphered', and an oversized unciphered size), per
  Simon's request for regression tests since these are security fixes.
- Added patch 4 as a prerequisite for patch 5: <u-boot/aes.h> defines
  the disabled-config cipher stubs with external linkage, so a second
  translation unit including it (the new test file) failed to link
  until those stubs were made static inline. Found while writing the
  test, not previously reported.

Patches 1 and 3 are unchanged from v1 and carry Simon's Reviewed-by.

checkpatch-clean, builds for sandbox (CONFIG_FIT_CIPHER=y) with no new
warnings at W=1, and the new fit_cipher suite plus the existing
lib_test_aes and fit_verity suites pass under `ut`.

Pranav Rajendran (5):
  lib: aes: reject a ciphertext length that is not a whole number of
    blocks
  image-fit: check the length of the data-size-unciphered property
  lib: aes: reject an unciphered size larger than the ciphertext
  include: u-boot: aes: make disabled cipher stubs static inline
  test: boot: add regression tests for the FIT cipher bounds checks

 boot/image-fit.c       |   7 ++-
 include/u-boot/aes.h   |  17 ++++---
 lib/aes/aes-decrypt.c  |  21 +++++++-
 test/boot/Makefile     |   1 +
 test/boot/fit_cipher.c | 113 +++++++++++++++++++++++++++++++++++++++++
 test/cmd_ut.c          |   2 +
 6 files changed, 151 insertions(+), 10 deletions(-)
 create mode 100644 test/boot/fit_cipher.c

-- 
2.50.1 (Apple Git-155)

[PATCH v2 1/5] lib: aes: reject a ciphertext length that is not a whole number of blocks

[Pranav Rajendran]

image_aes_decrypt() allocates cipher_len bytes for the plaintext but
then asks aes_cbc_decrypt_blocks() to write
DIV_ROUND_UP(cipher_len, AES_BLOCK_LENGTH) blocks into it. For a
cipher_len that is not a multiple of AES_BLOCK_LENGTH the rounding up
adds one block, so the last block is written up to AES_BLOCK_LENGTH - 1
bytes past the end of the allocation, and read the same distance past
the end of the ciphertext.

cipher_len is the size of the image data in the FIT, so an image with a
'data' property whose length is not block aligned is enough to reach
this. The overflowing bytes are decryption output, i.e. they depend on
the key, but the length itself is not covered by anything that would
stop the image from being parsed this far.

A CBC ciphertext is a whole number of blocks by construction, so treat
anything else as a malformed image and reject it before allocating.
With that established, compute the block count with a plain division so
the buffer size and the write length cannot drift apart again.

Fixes: 4df3578119b0 ("u-boot: fit: add support to decrypt fit with aes")
Signed-off-by: Pranav Rajendran <pranavkasthuri@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
---
(no changes since v1)

 lib/aes/aes-decrypt.c | 12 +++++++++++-
 1 file changed, 11 insertions(+), 1 deletion(-)

diff --git a/lib/aes/aes-decrypt.c b/lib/aes/aes-decrypt.c
index 741102a4723..85773a9c4f6 100644
--- a/lib/aes/aes-decrypt.c
+++ b/lib/aes/aes-decrypt.c
@@ -17,6 +17,16 @@ int image_aes_decrypt(struct image_cipher_info *info,
 	unsigned char key_exp[AES256_EXPAND_KEY_LENGTH];
 	unsigned int aes_blocks, key_len = info->cipher->key_len;
 
+	/*
+	 * The ciphertext is a whole number of AES blocks by construction, and
+	 * the decryption below writes one full block at a time, so anything
+	 * else would overflow the output buffer.
+	 */
+	if (!cipher_len || cipher_len % AES_BLOCK_LENGTH) {
+		printf("Invalid ciphertext length\n");
+		return -EINVAL;
+	}
+
 	*data = malloc(cipher_len);
 	if (!*data) {
 		printf("Can't allocate memory to decrypt\n");
@@ -30,7 +40,7 @@ int image_aes_decrypt(struct image_cipher_info *info,
 	aes_expand_key((u8 *)info->key, key_len, key_exp);
 
 	/* Calculate the number of AES blocks to encrypt. */
-	aes_blocks = DIV_ROUND_UP(cipher_len, AES_BLOCK_LENGTH);
+	aes_blocks = cipher_len / AES_BLOCK_LENGTH;
 
 	aes_cbc_decrypt_blocks(key_len, key_exp, (u8 *)info->iv,
 			       (u8 *)cipher, *data, aes_blocks);
-- 
2.50.1 (Apple Git-155)

[PATCH v2 2/5] image-fit: check the length of the data-size-unciphered property

[Pranav Rajendran]

fit_image_get_data_size_unciphered() passes NULL as fdt_getprop()'s
length argument, so it accepts a 'data-size-unciphered' property of any
size and then dereferences the first four bytes of it. A property
shorter than that is read past its end, and the bytes that follow it in
the FIT are returned to the caller as the unciphered size.

Ask for the length and require it to be exactly one fdt32_t, as the
binding describes.

Fixes: 4df3578119b0 ("u-boot: fit: add support to decrypt fit with aes")
Signed-off-by: Pranav Rajendran <pranavkasthuri@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
---
v2:
- Document the new -EINVAL return in the kernel-doc block above the
  function, per Simon's review comment.

 boot/image-fit.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/boot/image-fit.c b/boot/image-fit.c
index ef90c5abd18..872d71d2faf 100644
--- a/boot/image-fit.c
+++ b/boot/image-fit.c
@@ -1035,16 +1035,21 @@ int fit_image_get_data_size(const void *fit, int noffset, int *data_size)
  * returns:
  *     0, on success
  *     -ENOENT if the property could not be found
+ *     -EINVAL if the property is not exactly one fdt32_t long
  */
 int fit_image_get_data_size_unciphered(const void *fit, int noffset,
 				       size_t *data_size)
 {
 	const fdt32_t *val;
+	int len;
 
-	val = fdt_getprop(fit, noffset, "data-size-unciphered", NULL);
+	val = fdt_getprop(fit, noffset, "data-size-unciphered", &len);
 	if (!val)
 		return -ENOENT;
 
+	if (len != sizeof(*val))
+		return -EINVAL;
+
 	*data_size = (size_t)fdt32_to_cpu(*val);
 
 	return 0;
-- 
2.50.1 (Apple Git-155)

[PATCH v2 3/5] lib: aes: reject an unciphered size larger than the ciphertext

[Pranav Rajendran]

image_aes_decrypt() allocates cipher_len bytes, decrypts into them, and
then reports the plaintext length to its caller as
info->size_unciphered, without relating the two. size_unciphered comes
from the image's 'data-size-unciphered' property, so an image can claim
a plaintext larger than the buffer that was allocated for it.

fit_image_uncipher() propagates that length as the image size, and
everything downstream - the load, the copy to the entry point - works
from it, reading up to 4 GiB past the end of the decrypted buffer.

Unlike the image data itself, 'data-size-unciphered' is not covered by
the per-image hash or signature, so this is reachable on a signed FIT
whose signature still verifies.

Decryption produces exactly cipher_len bytes, so require the claimed
size to fit within that.

Fixes: 4df3578119b0 ("u-boot: fit: add support to decrypt fit with aes")
Signed-off-by: Pranav Rajendran <pranavkasthuri@gmail.com>
Reviewed-by: Simon Glass <sjg@chromium.org>
---
(no changes since v1)

 lib/aes/aes-decrypt.c | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/lib/aes/aes-decrypt.c b/lib/aes/aes-decrypt.c
index 85773a9c4f6..5d616983082 100644
--- a/lib/aes/aes-decrypt.c
+++ b/lib/aes/aes-decrypt.c
@@ -27,6 +27,15 @@ int image_aes_decrypt(struct image_cipher_info *info,
 		return -EINVAL;
 	}
 
+	/*
+	 * Decryption produces exactly cipher_len bytes, so the unciphered
+	 * size the image claims cannot be larger than that.
+	 */
+	if (info->size_unciphered > cipher_len) {
+		printf("Invalid unciphered size\n");
+		return -EINVAL;
+	}
+
 	*data = malloc(cipher_len);
 	if (!*data) {
 		printf("Can't allocate memory to decrypt\n");
-- 
2.50.1 (Apple Git-155)

[PATCH v2 4/5] include: u-boot: aes: make disabled cipher stubs static inline

[Pranav Rajendran]

image_aes_encrypt(), image_aes_add_cipher_data() and image_aes_decrypt()
are defined directly in this header, with full bodies rather than just
prototypes, whenever the corresponding IMAGE_ENABLE_ENCRYPT/DECRYPT
feature macro is 0. On target that is always the encrypt side, since
ciphering is host-tool only.

Those definitions have external linkage, so a second translation unit
including this header under the same disabled configuration collides
with the first at link time. Only boot/image-cipher.c currently
includes the header on target, so this has not been reachable before,
but it stops any other file - such as a unit test - from including it
too.

Make the disabled-path stubs static inline, as is conventional for
header-defined no-op fallbacks, so the header can be included from more
than one translation unit.

Signed-off-by: Pranav Rajendran <pranavkasthuri@gmail.com>
---
v2:
- New in v2. Needed by patch 5: the new fit_cipher test suite is a
  second translation unit including this header under the same
  disabled configuration, which failed to link before this change.

 include/u-boot/aes.h | 17 +++++++++--------
 1 file changed, 9 insertions(+), 8 deletions(-)

diff --git a/include/u-boot/aes.h b/include/u-boot/aes.h
index acbc50b9e6f..d72322c1013 100644
--- a/include/u-boot/aes.h
+++ b/include/u-boot/aes.h
@@ -16,15 +16,16 @@ int image_aes_encrypt(struct image_cipher_info *info,
 int image_aes_add_cipher_data(struct image_cipher_info *info, void *keydest,
 			      void *fit, int node_noffset);
 #else
-int image_aes_encrypt(struct image_cipher_info *info,
-		      const unsigned char *data, int size,
-		      unsigned char **cipher, int *cipher_len)
+static inline int image_aes_encrypt(struct image_cipher_info *info,
+				    const unsigned char *data, int size,
+				    unsigned char **cipher, int *cipher_len)
 {
 	return -ENXIO;
 }
 
-int image_aes_add_cipher_data(struct image_cipher_info *info, void *keydest,
-			      void *fit, int node_noffset)
+static inline int image_aes_add_cipher_data(struct image_cipher_info *info,
+					    void *keydest, void *fit,
+					    int node_noffset)
 {
 	return -ENXIO;
 }
@@ -35,9 +36,9 @@ int image_aes_decrypt(struct image_cipher_info *info,
 		      const void *cipher, size_t cipher_len,
 		      void **data, size_t *size);
 #else
-int image_aes_decrypt(struct image_cipher_info *info,
-		      const void *cipher, size_t cipher_len,
-		      void **data, size_t *size)
+static inline int image_aes_decrypt(struct image_cipher_info *info,
+				    const void *cipher, size_t cipher_len,
+				    void **data, size_t *size)
 {
 	return -ENXIO;
 }
-- 
2.50.1 (Apple Git-155)

[PATCH v2 5/5] test: boot: add regression tests for the FIT cipher bounds checks

[Pranav Rajendran]

Add a fit_cipher unit test suite, gated on CONFIG_FIT_CIPHER like the
code it exercises, covering the three defects fixed in this series:

 - image_aes_decrypt() rejects a cipher_len that is not a whole number
   of AES blocks
 - image_aes_decrypt() rejects an unciphered size larger than the
   ciphertext, and accepts the boundary case where they are equal
 - fit_image_get_data_size_unciphered() rejects a 'data-size-unciphered'
   property that is not exactly one fdt32_t long, built via a minimal
   FIT constructed with libfdt, and accepts a correctly sized one

Signed-off-by: Pranav Rajendran <pranavkasthuri@gmail.com>
---
v2:
- New in v2, per Simon's request for regression tests on this series.

 test/boot/Makefile     |   1 +
 test/boot/fit_cipher.c | 113 +++++++++++++++++++++++++++++++++++++++++
 test/cmd_ut.c          |   2 +
 3 files changed, 116 insertions(+)
 create mode 100644 test/boot/fit_cipher.c

diff --git a/test/boot/Makefile b/test/boot/Makefile
index 59a87028704..cef2a236d9b 100644
--- a/test/boot/Makefile
+++ b/test/boot/Makefile
@@ -18,6 +18,7 @@ ifdef CONFIG_UT_DM
 obj-$(CONFIG_$(PHASE_)OF_LIBFDT) += image_fdt.o
 endif
 endif
+obj-$(CONFIG_$(PHASE_)FIT_CIPHER) += fit_cipher.o
 obj-$(CONFIG_$(PHASE_)FIT_VERITY) += fit_verity.o
 obj-$(CONFIG_MEASURED_BOOT) += measurement.o
 
diff --git a/test/boot/fit_cipher.c b/test/boot/fit_cipher.c
new file mode 100644
index 00000000000..b98c69fcb0b
--- /dev/null
+++ b/test/boot/fit_cipher.c
@@ -0,0 +1,113 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Regression tests for the FIT cipher bounds checks in
+ * image_aes_decrypt() and fit_image_get_data_size_unciphered().
+ *
+ * Copyright 2026 Pranav Rajendran <pranavkasthuri@gmail.com>
+ */
+
+#include <errno.h>
+#include <image.h>
+#include <uboot_aes.h>
+#include <u-boot/aes.h>
+#include <linux/libfdt.h>
+#include <test/test.h>
+#include <test/ut.h>
+
+#define FIT_CIPHER_TEST(_name, _flags)	UNIT_TEST(_name, _flags, fit_cipher)
+
+/* A cipher_len that is not a whole number of AES blocks must be rejected */
+static int fit_cipher_test_unaligned_len(struct unit_test_state *uts)
+{
+	struct image_cipher_info info;
+	unsigned char key[AES128_KEY_LENGTH] = { 0 };
+	unsigned char iv[AES_BLOCK_LENGTH] = { 0 };
+	unsigned char cipher[AES_BLOCK_LENGTH + 1] = { 0 };
+	void *data = NULL;
+	size_t size = 0;
+	int ret;
+
+	memset(&info, 0, sizeof(info));
+	info.cipher = image_get_cipher_algo("aes128");
+	ut_assertnonnull(info.cipher);
+	info.key = key;
+	info.iv = iv;
+
+	ret = image_aes_decrypt(&info, cipher, sizeof(cipher), &data, &size);
+	ut_asserteq(-EINVAL, ret);
+	ut_assertnull(data);
+
+	return 0;
+}
+FIT_CIPHER_TEST(fit_cipher_test_unaligned_len, 0);
+
+/*
+ * An unciphered size larger than the ciphertext must be rejected; a size
+ * exactly equal to the ciphertext length is the valid boundary case.
+ */
+static int fit_cipher_test_oversized_unciphered_size(struct unit_test_state *uts)
+{
+	struct image_cipher_info info;
+	unsigned char key[AES128_KEY_LENGTH] = { 0 };
+	unsigned char iv[AES_BLOCK_LENGTH] = { 0 };
+	unsigned char cipher[AES_BLOCK_LENGTH * 2] = { 0 };
+	void *data = NULL;
+	size_t size = 0;
+	int ret;
+
+	memset(&info, 0, sizeof(info));
+	info.cipher = image_get_cipher_algo("aes128");
+	ut_assertnonnull(info.cipher);
+	info.key = key;
+	info.iv = iv;
+
+	info.size_unciphered = sizeof(cipher) + 1;
+	ret = image_aes_decrypt(&info, cipher, sizeof(cipher), &data, &size);
+	ut_asserteq(-EINVAL, ret);
+	ut_assertnull(data);
+
+	/* the boundary itself, size_unciphered == cipher_len, is valid */
+	info.size_unciphered = sizeof(cipher);
+	ut_assertok(image_aes_decrypt(&info, cipher, sizeof(cipher), &data,
+				      &size));
+	ut_assertnonnull(data);
+	ut_asserteq(sizeof(cipher), size);
+	free(data);
+
+	return 0;
+}
+FIT_CIPHER_TEST(fit_cipher_test_oversized_unciphered_size, 0);
+
+/*
+ * A 'data-size-unciphered' property that is not exactly one fdt32_t long
+ * must be rejected rather than read out of bounds.
+ */
+static int fit_cipher_test_data_size_unciphered_len(struct unit_test_state *uts)
+{
+	char fit[512];
+	int images, img, ret;
+	u16 truncated = 0x1234;
+	fdt32_t valid = cpu_to_fdt32(0x100);
+	size_t data_size = 0;
+
+	ut_assertok(fdt_create_empty_tree(fit, sizeof(fit)));
+	images = fdt_add_subnode(fit, 0, "images");
+	ut_assert(images >= 0);
+
+	img = fdt_add_subnode(fit, images, "kernel");
+	ut_assert(img >= 0);
+	ut_assertok(fdt_setprop(fit, img, "data-size-unciphered",
+				&truncated, sizeof(truncated)));
+
+	ret = fit_image_get_data_size_unciphered(fit, img, &data_size);
+	ut_asserteq(-EINVAL, ret);
+
+	/* a correctly sized property still works */
+	ut_assertok(fdt_setprop(fit, img, "data-size-unciphered",
+				&valid, sizeof(valid)));
+	ut_assertok(fit_image_get_data_size_unciphered(fit, img, &data_size));
+	ut_asserteq(0x100, data_size);
+
+	return 0;
+}
+FIT_CIPHER_TEST(fit_cipher_test_data_size_unciphered_len, 0);
diff --git a/test/cmd_ut.c b/test/cmd_ut.c
index 4328670d0d6..95e86f7dcf6 100644
--- a/test/cmd_ut.c
+++ b/test/cmd_ut.c
@@ -59,6 +59,7 @@ SUITE_DECL(env);
 SUITE_DECL(exit);
 SUITE_DECL(fdt);
 SUITE_DECL(fdt_overlay);
+SUITE_DECL(fit_cipher);
 SUITE_DECL(fit_verity);
 SUITE_DECL(font);
 SUITE_DECL(hush);
@@ -88,6 +89,7 @@ static struct suite suites[] = {
 	SUITE(exit, "shell exit and variables"),
 	SUITE(fdt, "fdt command"),
 	SUITE(fdt_overlay, "device tree overlays"),
+	SUITE(fit_cipher, "FIT cipher bounds checks"),
 	SUITE(fit_verity, "FIT dm-verity cmdline generation"),
 	SUITE(font, "font command"),
 	SUITE(hush, "hush behaviour"),
-- 
2.50.1 (Apple Git-155)