mcuboot icon indicating copy to clipboard operation
mcuboot copied to clipboard

bootutil: boot_validate_slot incorrectly identifies location of reset vector

Open de-nordic opened this issue 2 months ago • 0 comments

The boot_validate_slot allows to verify whether an image in secondary slot can really boot from primary slot, by checking whether reset vector of that secondary slot stored image is within range of primary slot. The feature is enabled with MCUBOOT_VERIFY_IMG_ADDRESS MCUboot config, and works only when MCUBOOT_IMAGE_NUMBER > 1, so more then one image is enabled, and there is no encryption enabled - as it requires reading secondary slot image after header.

Issue number 1: Reset vector offset from header is not calculated correctly as the offset of course will not be size of reset vector pointer, but rather of something that precedes it https://github.com/mcu-tools/mcuboot/blob/aed3fb9587c4bbb64faa78c27cc45e60a1c2e79a/boot/bootutil/src/loader.c#L1015

Issue number 2 The code reading reset vector is expecting the certain layout of a binary, that can be assured by ARM_CORTEX_M , where reset vector indeed is placed at uint32_t size offset from header, but on other devices and arm devices that may not be a case: https://github.com/mcu-tools/mcuboot/blob/aed3fb9587c4bbb64faa78c27cc45e60a1c2e79a/boot/zephyr/main.c#L135-L148

de-nordic avatar Sep 30 '25 14:09 de-nordic