alex/esp-idf
alex/esp-idf
1
0
Fork 0
mirror of https://github.com/espressif/esp-idf.git synced 2024-10-05 20:47:46 -04:00
Code Issues Actions 2 Packages Projects Releases Wiki Activity

fix(secure_ota): secure app verification issue without padding bytes

Browse Source 
For the following configuration case:

 - CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME
 - CONFIG_SECURE_SIGNED_ON_UPDATE_NO_SECURE_BOOT
 - CONFIG_SECURE_BOOT_ALLOW_SHORT_APP_PARTITION

verification of the application was failing because the externally
padded bytes were not considered in the hash (checksum) process.

This commit fixes the problem by enabling relevant code for secure OTA
without secure boot case.

Closes https://github.com/espressif/esp-idf/issues/11995
This commit is contained in:
Mahavir Jain 2023-08-02 19:22:34 +05:30
parent c920123629
commit 52c9c342bd
No known key found for this signature in database
GPG Key ID: 99324EF4A00734E0
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
components/bootloader_support/src/esp_image_format.c
View File

@ -860,7 +860,7 @@ static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_han
bootloader_munmap(simple_hash);
}
#if CONFIG_SECURE_BOOT_V2_ENABLED
#if CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
// End of the image needs to be padded all the way to a 4KB boundary, after the simple hash
// (for apps they are usually already padded due to --secure-pad-v2, only a problem if this option was not used.)
uint32_t padded_end = ALIGN_UP(end, FLASH_SECTOR_SIZE);
@ -870,7 +870,7 @@ static esp_err_t verify_secure_boot_signature(bootloader_sha256_handle_t sha_han
bootloader_munmap(padding);
end = padded_end;
}
#endif
#endif // CONFIG_SECURE_SIGNED_APPS_RSA_SCHEME || CONFIG_SECURE_SIGNED_APPS_ECDSA_V2_SCHEME
bootloader_sha256_finish(sha_handle, image_digest);