dilim/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2026-08-09 17:38:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

boot: clamp setup header copy size to sizeof(SetupHeader)

Browse Source 
The setup_size field from the kernel image header is used as part
of the memcpy size. Clamp it to sizeof(SetupHeader) to ensure the
copy does not read beyond the struct bounds even if the kernel
image header contains an unexpected value.

CID#1549197

Follow-up for d62c177756
This commit is contained in:
Luca Boccassi
2026-03-28 22:06:51 +00:00
parent 24bdc49c23
commit a770fb3e14
1 changed files with 6 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/boot/linux_x86.c
View File

@@ -195,9 +195,14 @@ EFI_STATUS linux_exec_efi_handover(
/* Setup size is determined by offset 0x0202 + byte value at offset 0x0201, which is the same as
* offset of the header field and the target from the jump field (which we split for this reason). */
size_t setup_hdr_len;
if (!ADD_SAFE(&setup_hdr_len, offsetof(SetupHeader, header), image_params->hdr.setup_size))
setup_hdr_len = sizeof(SetupHeader);
else
setup_hdr_len = MIN(setup_hdr_len, sizeof(SetupHeader));
memcpy(&boot_params->hdr,
&image_params->hdr,
offsetof(SetupHeader, header) + image_params->hdr.setup_size);
setup_hdr_len);
boot_params->hdr.type_of_loader = 0xff;