This prevents avbroot writing to locations where it shouldn't due to
manipulation from external processes. For example, replacing the output
directory for `avbroot ota extract` with a symlink.
Regardless of what symlinks or other changes an external process does to
the directory, the cap-std library will use the appropriate `openat2()`
options (or equivalent) to prevent writes outside of the directory.
Fixes: #166
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This is the only part of the payload that we have to read entirely into
memory. The limit is currently set to 1 MiB, which is around ~5-6x the
manifest size in all the e2e test suite's images.
Issue: #169
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This way we can't run out of memory if the zip entry lists an invalid
file size that's much bigger than the actual file.
Issue: #157
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This also limits the block size to 16384. There are currently no known
images that use anything larger than 4096.
Issue: #157
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This prevents avbroot from being killed for excessive memory usage due
to the entry header specifying a very large file name or file size
(larger than what's actually contained in the file).
This threshold for switching to incremental reallocation is 1 KiB for
file names and 1 MiB for file data.
Issue: #157
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This initially includes fuzzers for the AVB and boot image parsers. The
initial input corpus are the same test files we use for the round trip
tests.
Issue: #160
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The kernel, ramdisk(s), second stage bootloader, and device tree
components are limited to 64 MiB. In practice, no device has boot
partitions larger than 64 MiB, so this limit should never be hit. The
vendor v4 bootconfig component is limited to 1 KiB, which is about ~25x
the size of the Pixel 7 Pro's bootconfig.
Issue: #157
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
AVB 2.0 mandates that the header is 64 KiB or less, so enforce this both
when parsing and when writing vbmeta headers. Hash trees and FEC data
are also read into memory, so enforce limits corresponding to a 4 GiB
partition image.
Since these limits are so small, this lets us remove nearly all checked
integer conversions since a direct cast will never result in truncation.
Issue: #157
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The longer PR links have weird line wrapping behavior on the Github web
UI, making it more difficult to read.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Andrew Gunnerson