Skip to content

imgtool.py dumpinfo crash with struct.error #1976

@dhMat

Description

@dhMat

During testing imgtool I recognized that python imgtool.py dumpinfo ... crashes with following error:

Traceback (most recent call last):
  File "C:\temp\mcuboot\scripts\imgtool.py", line 22, in <module>
    main.imgtool()
  File "C:\Program Files\Python310\lib\site-packages\click\core.py", line 1130, in __call__
    return self.main(*args, **kwargs)
  File "C:\Program Files\Python310\lib\site-packages\click\core.py", line 1055, in main
    rv = self.invoke(ctx)
  File "C:\Program Files\Python310\lib\site-packages\click\core.py", line 1657, in invoke
    return _process_result(sub_ctx.command.invoke(sub_ctx))
  File "C:\Program Files\Python310\lib\site-packages\click\core.py", line 1404, in invoke
    return ctx.invoke(self.callback, **ctx.params)
  File "C:\Program Files\Python310\lib\site-packages\click\core.py", line 760, in invoke
    return __callback(*args, **kwargs)
  File "C:\temp\mcuboot\scripts\imgtool\main.py", line 244, in dumpinfo
    dump_imginfo(imgfile, outfile, silent)
  File "C:\temp\mcuboot\scripts\imgtool\dumpinfo.py", line 90, in dump_imginfo
    _tlv_prot_head = struct.unpack(
struct.error: unpack requires a buffer of 4 bytes

The key used for testing was generated with following command:
python imgtool.py keygen -k test_keys.pem -t ecdsa-p256

The image was signed with:
python imgtool.py sign -k test_keys.pem -v 1.0 -H 256 --pad-header -S 0x0000 "C:\temp\mcuboot_fw.hex" "C:\temp\mcuboot_fw_signed.hex"

When checking the file with python verify everthing looks fine. Only when the dumpinfo command is used the program crash.

Short investigation

When adding following code before the command that crash in dumpinfo.py", line 90:

        print(b[tlv_off:(tlv_off + image.TLV_INFO_SIZE)])
        print(f"data len: {len(b)}")
        print(f"tlv_off: {tlv_off}, TLV_INFO_SIZE: {image.TLV_INFO_SIZE}, protected_tlv_size: {protected_tlv_size}")

following results are printed

b''
data len: 278946
tlv_off: 221542010, TLV_INFO_SIZE: 4, protected_tlv_size: 17975

For whatever reason the tlv offset is bigger than the available data, which leads to the crash.

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    Status

    No status

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions