From 186032e1ed93dde8671d4a3106715bd34f9181e0 Mon Sep 17 00:00:00 2001
From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Fri, 13 Mar 2026 01:52:12 +0000
Subject: [PATCH] boot: add checks for invalid splash images in UKI

A malformed bmp with 8bits depth but smaller color
map would cause out of bounds reads. This is not a real
problem as the image is signed, but better to be safe.

Reported on yeswehack.com as:
YWH-PGM9780-135

Follow-up for 0fa2cac4f0cdefaf1addd7f1fe0fd8113db9360b
---
 src/boot/splash.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/boot/splash.c b/src/boot/splash.c
index 86d4238eb1..19bd4bff74 100644
--- a/src/boot/splash.c
+++ b/src/boot/splash.c
@@ -119,6 +119,12 @@ static EFI_STATUS bmp_parse_header(
                         return EFI_INVALID_PARAMETER;
         }
 
+        /* Ensure there can be no OOB accesses in bmp_to_blt() due to malformed images (e.g.: color depth 8
+         * but smaller color map) via map[*in]. */
+        if (IN_SET(dib->depth, 1, 4, 8) &&
+            file->offset - (sizeof(struct bmp_file) + dib->size) < sizeof(struct bmp_map) * (1U << dib->depth))
+                return EFI_INVALID_PARAMETER;
+
         *ret_map = map;
         *ret_dib = dib;
         *pixmap = bmp + file->offset;