From: Pali Rohár <pali@kernel.org>
Date: Sun, 29 Jan 2023 13:33:36 +0000 (+0100)
Subject: tools: kwbimage: Fix generating secure boot data image signature
X-Git-Tag: v2025.01-rc5-pxa1908~1023^2~41^2~16
X-Git-Url: http://git.dujemihanovic.xyz/img/static/html/%7B%7B?a=commitdiff_plain;h=bf78a57e9a84ef4c882acd8c8710d364ed90730e;p=u-boot.git

tools: kwbimage: Fix generating secure boot data image signature

Secure boot data image signature is calculated from the data image without
trailing 4-bit checksum. Commit 37cb9c15d70d ("tools: kwbimage: Simplify
aligning and calculating checksum") unintentionally broke this calculation
when it increased payloadsz variable by 4 bytes which was propagated also
into the add_secure_header_v1() function. Fix this issue by decreasing size
of buffer by 4 bytes from which is calculated secure boot data image
signature.

Fixes: 37cb9c15d70d ("tools: kwbimage: Simplify aligning and calculating checksum")
Signed-off-by: Pali Rohár <pali@kernel.org>
---

diff --git a/tools/kwbimage.c b/tools/kwbimage.c
index b32f845b7e..a8a59c154b 100644
--- a/tools/kwbimage.c
+++ b/tools/kwbimage.c
@@ -1355,7 +1355,7 @@ static int add_secure_header_v1(struct image_tool_params *params, uint8_t *image
 	if (kwb_sign_csk_with_kak(params, secure_hdr, csk))
 		return 1;
 
-	if (kwb_sign_and_verify(csk, image_ptr, image_size,
+	if (kwb_sign_and_verify(csk, image_ptr, image_size - 4,
 				&secure_hdr->imgsig, "image") < 0)
 		return 1;