dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-11 09:36:28 +00:00
Code Issues Packages Projects Releases Wiki Activity

boot: reject inner kernel entry point outside the image

Browse Source 
pe_kernel_info() returned AddressOfEntryPoint (and the .compat section
entry_point) straight from the PE header with no check against
SizeOfImage. Since cab9c7b5a4 the stub calls the inner kernel directly
as ImageBase + entry_point, and only EFI_SIZE_TO_PAGES(SizeOfImage) pages
are allocated for it.

Follow-up for cab9c7b5a4

(cherry picked from commit ecf3f5056a)
(cherry picked from commit 1dbedeef33)
(cherry picked from commit a10dd5d8df)
This commit is contained in:
Luca Boccassi
2026-06-26 19:57:23 +01:00
parent b203203576
commit 5a569c49b2
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/boot/pe.c
View File

@@ -495,6 +495,10 @@ EFI_STATUS pe_kernel_info(
return EFI_UNSUPPORTED;
if (pe->FileHeader.Machine == TARGET_MACHINE_TYPE) {
/* The entry point is later called as ImageBase + entry_point, and only SizeOfImage
* bytes are allocated for the image, so reject an entry point outside of it. */
if (pe->OptionalHeader.AddressOfEntryPoint >= size_in_memory)
return EFI_LOAD_ERROR;
if (ret_entry_point)
*ret_entry_point = pe->OptionalHeader.AddressOfEntryPoint;
if (ret_compat_entry_point)
@@ -510,6 +514,9 @@ EFI_STATUS pe_kernel_info(
if (compat_entry_point == 0)
/* Image type not supported and no compat entry found. */
return EFI_UNSUPPORTED;
if (compat_entry_point >= size_in_memory)
/* Same as above: the compat entry point is called as ImageBase + entry_point. */
return EFI_LOAD_ERROR;
if (ret_entry_point)
*ret_entry_point = 0;