]> git.dujemihanovic.xyz Git - u-boot.git/commit
bootstage: Fix out-of-bounds read in reloc_bootstage()
authorRichard Weinberger <richard@nod.at>
Wed, 31 Jul 2024 16:07:54 +0000 (18:07 +0200)
committerTom Rini <trini@konsulko.com>
Thu, 15 Aug 2024 20:35:31 +0000 (14:35 -0600)
commit1779a58c66a8229ebc18c08c11f9c7e71b3fd982
tree99e25206ef738f37ae3db1ae4f06fd656602d382
parentfaf73fb70da91a5bccc8791be6dccdea99dee829
bootstage: Fix out-of-bounds read in reloc_bootstage()

bootstage_get_size() returns the total size of the data structure
including associated records.
When copying from gd->bootstage, only the allocation size of gd->bootstage
must be used. Otherwise too much memory is copied.

This bug caused no harm so far because gd->new_bootstage is always
large enough and reading beyond the allocation length of gd->bootstage
caused no problem due to the U-Boot memory layout.

Fix by using the correct size and perform the initial copy directly
in bootstage_relocate() to have the whole relocation process in the
same function.

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Simon Glass <sjg@chromium.org>
common/board_f.c
common/bootstage.c
include/bootstage.h