forked from pool/u-boot
39c34ab531
Update to v2016.09.01 and fix aarch64 efistub boot OBS-URL: https://build.opensuse.org/request/show/435542 OBS-URL: https://build.opensuse.org/package/show/openSUSE:Factory/u-boot?expand=0&rev=82
52 lines
1.8 KiB
Diff
52 lines
1.8 KiB
Diff
From d8c0aafcdfb413eb414801c58c23a528f4e0a8b7 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Stefan=20Br=C3=BCns?= <stefan.bruens@rwth-aachen.de>
|
|
Date: Sun, 9 Oct 2016 22:17:07 +0200
|
|
Subject: [PATCH] efi_loader: Fix memory map size check to avoid out-of-bounds
|
|
access
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
The current efi_get_memory_map() function overwrites the map_size
|
|
property before reading its value. That way the sanity check whether our
|
|
memory map fits into the given array always succeeds, potentially
|
|
overwriting arbitrary payload memory.
|
|
|
|
This patch moves the property update write after its sanity check, so
|
|
that the check actually verifies the correct value.
|
|
|
|
So far this has not triggered any known bugs, but we're better off safe
|
|
than sorry.
|
|
|
|
If the buffer is to small, the returned memory_map_size indicates the
|
|
required size to the caller.
|
|
|
|
Signed-off-by: Stefan Brüns <stefan.bruens@rwth-aachen.de>
|
|
Reviewed-by: Alexander Graf <agraf@suse.de>
|
|
Signed-off-by: Alexander Graf <agraf@suse.de>
|
|
---
|
|
lib/efi_loader/efi_memory.c | 3 ++-
|
|
1 file changed, 2 insertions(+), 1 deletion(-)
|
|
|
|
diff --git a/lib/efi_loader/efi_memory.c b/lib/efi_loader/efi_memory.c
|
|
index ebe8e94..1d23783 100644
|
|
--- a/lib/efi_loader/efi_memory.c
|
|
+++ b/lib/efi_loader/efi_memory.c
|
|
@@ -336,6 +336,7 @@ efi_status_t efi_get_memory_map(unsigned long *memory_map_size,
|
|
ulong map_size = 0;
|
|
int map_entries = 0;
|
|
struct list_head *lhandle;
|
|
+ unsigned long provided_map_size = *memory_map_size;
|
|
|
|
list_for_each(lhandle, &efi_mem)
|
|
map_entries++;
|
|
@@ -350,7 +351,7 @@ efi_status_t efi_get_memory_map(unsigned long *memory_map_size,
|
|
if (descriptor_version)
|
|
*descriptor_version = EFI_MEMORY_DESCRIPTOR_VERSION;
|
|
|
|
- if (*memory_map_size < map_size)
|
|
+ if (provided_map_size < map_size)
|
|
return EFI_BUFFER_TOO_SMALL;
|
|
|
|
/* Copy list into array */
|