* Remove the ReadString trait and perform UTF-8 conversions explicitly.
UTF-8 conversion errors are now individual errors instead of being
hidden in an Io error.
* Add new IntOutOfBounds errors that include the actual field value and
the range of values that are valid for the field. Integer casting also
uses this error type where possible.
* Replace remaining uses of FieldOutOfBounds with IntOverflow, which is
returned when checked arithmetic fails. For code simplicity, it does
not store intermediate values.
* Replace ReadFieldError and WriteFieldError with the generic Io error
to simplify the code. They were used inconsistently anyway.
* Use fully qualified field names in avb and bootimage error messages
since the same name frequently appears in multiple structs.
* Replace InvalidFieldValue with more specific errors in bootimage.
* Replace all stringly-typed errors in lp and sparse with (very)
specific errors.
* Fix the wording in a number of errors.
* Add new ReadFixedSizeExt trait for reading fixed size arrays and vecs
from Read types.
* Remove some fallible casts from u32 to usize and from usize to u64.
avbroot only supports 32-bit and 64-bit systems anyway.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
avbroot will not support patching these internal OTAs because it
requires modifying filesystems and creating incremental OTAs. However,
it should be possible to do this manually if someone really wants to try
out a 16K page size kernel.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Neither of the two new fields need any special handling in avbroot. This
just allows us to preserve the values from the original OTA.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This commit also fixes a bug where avb::Header::release_string was
allowed to take the full 48-bytes, which was incorrect because libavb
expects the field to be NULL-terminated. This was not a problem in
practice because the release string is usually short and even if it
wasn't, the 80 reserved bytes that immediately follow it are all zeros.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
The official AOSP implementation does, so we should too. This allows
unpacking Samsung's sparse images, which have an extra 4 bytes in both
the file header and chunk headers.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Older OTAs created before the payload metadata format supported EC
signatures will not have the `unpadded_signature_size` field set. In
this case, we'll just use the full length of `data`, which is what
update_engine also does.
Issue: #366
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
While patched OTAs produced by avbroot always include the protobuf
version of the OTA metadata, the original OTA may not. Verifying those
with `avbroot ota verify` is a valid use case.
Issue: #366
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
This computes the special SHA256 digest that is equal to the
ro.boot.vbmeta.digest property value on a real device.
Signed-off-by: Andrew Gunnerson <accounts+github@chiller3.com>
Andrew Gunnerson