commit 35ff8167956e26d2d0c054425a3b613df462720c
author Raef Coles <raef.coles@arm.com> Thu Dec 12 13:43:15 2019 +0000
committer David Vincze <david.vincze@arm.com> Mon Jan 27 14:54:45 2020 +0100
tree 41abed8a87a7b37eaa2a51281ac9ce9a3c5aee9a
parent c3e313a37c583ffbc8042656ad59e7cda6fd656c

Boot: Fix buffer overflow in image sector check

Initialise swap space pointer in all cases to prevent overwriting of
bootloader.

Change-Id: I14068a016a6f1ce5ebbdf35ea26c4f4e2cecaece
Signed-off-by: Raef Coles <raef.coles@arm.com>

bl2/ext/mcuboot/bootutil/src/loader.c

diff --git a/bl2/ext/mcuboot/bootutil/src/loader.c b/bl2/ext/mcuboot/bootutil/src/loader.c
index e604677..2197a47 100644
--- a/bl2/ext/mcuboot/bootutil/src/loader.c
+++ b/bl2/ext/mcuboot/bootutil/src/loader.c
@@ -2672,9 +2672,11 @@
 
     static boot_sector_t primary_slot_sectors[BOOT_MAX_IMG_SECTORS];
     static boot_sector_t secondary_slot_sectors[BOOT_MAX_IMG_SECTORS];
+    static boot_sector_t scratch_sectors[BOOT_MAX_IMG_SECTORS];
 
-    BOOT_IMG(state, BOOT_PRIMARY_SLOT).sectors = &primary_slot_sectors[0];
-    BOOT_IMG(state, BOOT_SECONDARY_SLOT).sectors = &secondary_slot_sectors[0];
+    BOOT_IMG(state, BOOT_PRIMARY_SLOT).sectors = primary_slot_sectors;
+    BOOT_IMG(state, BOOT_SECONDARY_SLOT).sectors = secondary_slot_sectors;
+    state->scratch.sectors = scratch_sectors;
 
     /* Open boot_data image areas for the duration of this call. */
     for (i = 0; i < BOOT_NUM_SLOTS; i++) {