boot: bootutil: bounds-check TLV length in tlv iterator

[d3zd3z]

Summary

Adds a bounds check to bootutil_tlv_iter_next() so that a TLV header and its payload are verified to lie fully within the TLV section before the iterator advances or hands an (off, len) pair to the caller.

tlv.it_len is a uint16_t read straight from flash and is attacker-controlled in a crafted image. Without this check, a bogus length advances it->tlv_off past it->tlv_end and yields an out-of-section (off, len) pair.

Severity / framing

This is a defense-in-depth / robustness fix, not a critical vulnerability:

• Every current consumer in image_validate.c already validates len against a small fixed buffer before reading (hash, key, signature, security counter, UUID), so a bogus it_len does not currently cause a large out-of-bounds read or a buffer overflow.
• An overshooting iterator previously just terminated the while (it->tlv_off < it->tlv_end) loop early; malformed TLVs cause validation to fail closed, not to be bypassed.

The value of the fix is that it makes the iterator self-contained and correct instead of relying on every current and future caller to sanity-check len, and it converts silent early-termination on a malformed image into an explicit error.

Behavioural change

Malformed TLV lengths now produce an explicit iteration error (-1) instead of silently truncating iteration. For valid images the check is a no-op.

The check

The three clauses short-circuit left-to-right so the uint32_t arithmetic can neither underflow nor wrap: clause 1 guards the subtraction in the later clauses, and clause 2 ensures sizeof(tlv) fits before clause 3 subtracts it.

Testing

Existing sim suite passes unchanged with sig-rsa, sig-ecdsa, and sig-ecdsa,swap-offset (25 tests each). The check is a no-op for any well-formed image, so no behavioural change is expected for valid images. No dedicated negative test is added: the prior behaviour was already fail-closed, so a crafted-image test would exercise a path whose observable outcome is unchanged.

[Copilot]

Pull request overview

Adds TLV iterator validation intended to reject malformed TLV entries whose payload would extend beyond the declared TLV section.

Changes:

• Adds length/bounds validation in bootutil_tlv_iter_next().
• Logs and returns an explicit iteration error for malformed TLV sizes.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.