ninharp/ninlight-w600
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

fix: nl_mkimage Verifikation robuster gegen Edge Cases und Misuse

Browse Source 
Critical 1: path.read_bytes() fiel auf nonexistent file oder Directory mit
Traceback statt einer Fehlerzeile. Jetzt OSError-Familie abgefangen.

Critical 2: --device/--version mit Leerzeichen wurden stillschweigend
akzeptiert; das zerlegt das Ausgabeformat und bricht Task 4s Skript.
Jetzt whitespace beim Bauen abgelehnt.

Important 1: Gerätefeld muss in C wie in Python null-terminiert sein.
Die Firmware checkt das unabhängig von --expect-device; Python nur mit
Flag. Jetzt Terminierung immer verlangt.

Important 2: Modi waren nicht exklusiv; --verify mit Baumodus-Argumenten
wurde stillschweigend ignoriert. Jetzt Fehler statt falschem Vertrauen.

Neue Tests für alle vier Szenarien + nonexistent file, directory, empty
file, Trailer ohne Payload, Mode-Mischung.

Co-Authored-By: Claude Haiku 4.5 <noreply@anthropic.com>
This commit is contained in:
Michael Sauer
2026-09-12 12:30:42 +02:00
co-authored by Claude Haiku 4.5
parent 0ba269a39a
commit df8e796f1e
2 changed files with 131 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
tools/mkimage/nl_mkimage.py
+23 -3
View File
@@ -19,12 +19,18 @@ def field(value: str, name: str) -> bytes:
raw = value.encode()
if len(raw) >= FIELD:
sys.exit(f"error: {name} '{value}' is too long (max {FIELD - 1} bytes)")
if any(c.isspace() for c in value):
sys.exit(f"error: {name} '{value}' contains whitespace")
return raw.ljust(FIELD, b"\x00")
def verify(path: Path, expect_device: str | None) -> int:
"""Checks an _ota.img the way the firmware does before accepting it."""
data = path.read_bytes()
try:
data = path.read_bytes()
except OSError as e:
print(f"error: {e}", file=sys.stderr)
return 1
if len(data) <= TRAILER_SIZE:
print(f"error: {path} is too short to carry a trailer", file=sys.stderr)
return 1
@@ -36,7 +42,12 @@ def verify(path: Path, expect_device: str | None) -> int:
print(f"error: {path} has trailer version {trailer[4]}, expected {TRAILER_VERSION}",
file=sys.stderr)
return 1
device = trailer[5:21].rstrip(b"\x00").decode("ascii", "replace")
# Device field must be null-terminated within its 16 bytes (same as firmware check)
device_field = trailer[5:21]
if b"\x00" not in device_field:
print(f"error: {path} has unterminated device field", file=sys.stderr)
return 1
device = device_field.rstrip(b"\x00").decode("ascii", "replace")
version = trailer[21:37].rstrip(b"\x00").decode("ascii", "replace")
if expect_device is not None and device != expect_device:
print(f"error: {path} carries device '{device}', expected '{expect_device}'",
@@ -61,13 +72,22 @@ def main() -> None:
a = p.parse_args()
if a.verify is not None:
# Verify mode: check that build arguments are not provided
build_args = ("image", "device", "version", "out")
if any(getattr(a, name) is not None for name in build_args):
p.error("--verify cannot be combined with build mode arguments (--image, --device, --version, --out)")
raise SystemExit(verify(a.verify, a.expect_device))
# Build mode: require all arguments
for name in ("image", "device", "version", "out"):
if getattr(a, name) is None:
p.error(f"--{name} is required unless --verify is given")
data = a.image.read_bytes()
try:
data = a.image.read_bytes()
except OSError as e:
sys.exit(f"error: {e}")
if len(data) > TRAILER_SIZE and data[-TRAILER_SIZE : -TRAILER_SIZE + 4] == b"NINL":
sys.exit("error: image already carries a trailer")