PT-2026-146107

bootutil img hash computes the image digest over ih hdr size + ih img size + ih protect tlv size bytes, all three taken from the candidate image's header, and reads that span out of the slot without checking that it fits in the flash area. The three sizes are also summed without an overflow check...