[PATCH 1/1] efi_loader: fix invocation of efi_prepare_aligned_image
Heinrich Schuchardt
heinrich.schuchardt at canonical.com
Sun Jul 30 09:34:53 CEST 2023
When passing a pointer to a size_t variable to a function writing an u64
value to the address a buffer overrun occurs on 32bit systems.
Fixes: 163a0d7e2cbd ("efi_loader: add PE/COFF image measurement")
Reported-by: Dan Carpenter <dan.carpenter at linaro.org>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt at canonical.com>
---
lib/efi_loader/efi_image_loader.c | 6 ++++--
1 file changed, 4 insertions(+), 2 deletions(-)
diff --git a/lib/efi_loader/efi_image_loader.c b/lib/efi_loader/efi_image_loader.c
index 26df0da16c..71c713048d 100644
--- a/lib/efi_loader/efi_image_loader.c
+++ b/lib/efi_loader/efi_image_loader.c
@@ -591,6 +591,8 @@ static bool efi_image_authenticate(void *efi, size_t efi_size)
struct pkcs7_message *msg = NULL;
struct efi_signature_store *db = NULL, *dbx = NULL;
void *new_efi = NULL;
+ u64 new_efi_size = efi_size;
+
u8 *auth, *wincerts_end;
size_t auth_size;
bool ret = false;
@@ -600,11 +602,11 @@ static bool efi_image_authenticate(void *efi, size_t efi_size)
if (!efi_secure_boot_enabled())
return true;
- new_efi = efi_prepare_aligned_image(efi, (u64 *)&efi_size);
+ new_efi = efi_prepare_aligned_image(efi, &new_efi_size);
if (!new_efi)
return false;
- if (!efi_image_parse(new_efi, efi_size, ®s, &wincerts,
+ if (!efi_image_parse(new_efi, new_efi_size, ®s, &wincerts,
&wincerts_len)) {
log_err("Parsing PE executable image failed\n");
goto out;
--
2.40.1
More information about the U-Boot
mailing list