1
0
mirror of https://github.com/esp8266/Arduino.git synced 2025-04-19 23:22:16 +03:00
David Baka d7c50f76aa
Updater - fixed signature verification for compressed binaries (#9109)
Previously, Arduino Core attempted to read from flash memory without proper consideration for the 4-byte alignment requirement when calculating the hash for the signature verification. This did not present an issue when uncompressed binaries are checked as all compiled binaries are 4-aligned (unconfirmed, just an educated guess), and signature verification appears to work well in these cases.

When uploading a compressed binary (based on this) the gzip algorithm makes no attempt to produce a 4-aligned file. The rest of the signing results in a valid signed binary regardless, however when calculating the hash for the verification process there is a ~75% chance that the hash will include some bytes from the signature, thus compromising the whole signature verification process.

editorial note: ESP.flashRead for u8 arrays (aka byte arrays) was already updated to properly handle both aligned and unaligned target buffer and / or length, while u32 expects that its arguments are already aligned. Since array pointer in Updater is already aligned, this properly handles unaligned size case.
2024-03-27 16:07:29 +03:00
..
2019-05-14 00:09:54 +02:00
2019-05-14 00:09:54 +02:00
2021-03-14 17:36:20 -07:00
2024-03-26 10:58:20 +03:00
2024-03-26 10:58:20 +03:00
2023-01-11 03:48:30 +03:00
2023-01-11 03:48:30 +03:00
2024-03-26 10:58:20 +03:00
2022-05-29 08:20:13 +03:00
2023-01-03 01:40:53 +03:00
2020-04-23 12:15:21 -04:00
2022-02-10 18:25:18 +01:00
2021-03-14 17:36:20 -07:00
2023-01-03 01:40:53 +03:00
2022-06-08 23:19:59 +02:00
2024-03-17 20:58:39 +03:00
2019-05-14 00:09:54 +02:00
2021-07-26 22:27:44 +02:00
2021-03-14 17:36:20 -07:00
2019-05-14 00:09:54 +02:00
2019-11-04 23:14:35 -03:00
2020-04-23 12:15:21 -04:00
2021-03-14 17:36:20 -07:00
2019-05-14 00:09:54 +02:00
2019-05-14 00:09:54 +02:00
2024-02-11 18:51:35 +01:00
2022-06-14 18:33:09 +03:00
2014-12-01 00:34:28 +03:00
2023-01-09 21:36:26 +03:00
2024-03-25 00:15:29 +01:00