[U-Boot] [PATCH 2/6] efi_loader: Fix memory map size check to avoid out-of-bounds access
Alexander Graf
agraf at suse.de
Fri Sep 30 16:22:03 CEST 2016
On 30.09.16 16:15, Brüns, Stefan wrote:
> On Freitag, 30. September 2016 14:25:40 CEST Alexander Graf wrote:
>> On 30.09.16 02:03, Stefan Brüns wrote:
>>> memory_map_size as IN parameter specifies the size of the provided buffer.
>>> If the buffer is to small, memory_map_size is updated to indicate the
>>> required size, and an error code is returned.
>>>
>>> Signed-off-by: Stefan Brüns <stefan.bruens at rwth-aachen.de>
>>
>> This patch doesn't actually change anything, does it?
>
> It does ...
>
>>
>> Alex
>>
>>> ---
>>>
>>> lib/efi_loader/efi_memory.c | 8 +++++---
>>> 1 file changed, 5 insertions(+), 3 deletions(-)
>>>
>>> diff --git a/lib/efi_loader/efi_memory.c b/lib/efi_loader/efi_memory.c
>>> index ebe8e94..5d71fdf 100644
>>> --- a/lib/efi_loader/efi_memory.c
>>> +++ b/lib/efi_loader/efi_memory.c
>>> @@ -342,16 +342,18 @@ efi_status_t efi_get_memory_map(unsigned long
>>> *memory_map_size,>
>>> map_size = map_entries * sizeof(struct efi_mem_desc);
>>>
>>> - *memory_map_size = map_size;
>
> The caller provided buffer size was changed here
>
>>> -
>>>
>>> if (descriptor_size)
>>>
>>> *descriptor_size = sizeof(struct efi_mem_desc);
>>>
>>> if (descriptor_version)
>>>
>>> *descriptor_version = EFI_MEMORY_DESCRIPTOR_VERSION;
>>>
>>> - if (*memory_map_size < map_size)
>
> -> this check was always false
Ah, I see it now. Could you please adjust the commit message to point
that out properly? :)
Thanks!
Alex
More information about the U-Boot
mailing list