SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

stub: more hardening against malformed images

Browse Source 
Avoid issues with malformed images.

Reported on various yeswehack.com reports

YWH-PGM9780-73
YWH-PGM9780-68
YWH-PGM9780-67
YWH-PGM9780-87
This commit is contained in:
Luca Boccassi
2026-02-18 15:05:44 +00:00
committed by GitHub
parent cec9eb5e7e
commit 1cd2ff3cca
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/boot/linux.c
+8
View File
@@ -275,8 +275,16 @@ EFI_STATUS linux_exec(
if (h->SizeOfRawData == 0)
continue;
if (UINT32_MAX - h->VirtualAddress < h->SizeOfRawData)
return log_error_status(EFI_LOAD_ERROR, "Invalid PE section, SizeOfRawData + VirtualAddress, overflows");
if (h->VirtualAddress + h->SizeOfRawData > kernel_size_in_memory)
return log_error_status(EFI_LOAD_ERROR, "Section would write outside of memory");
if (h->SizeOfRawData > h->VirtualSize)
return log_error_status(EFI_LOAD_ERROR, "Invalid PE section, raw data size is greater than virtual size");
if (UINT32_MAX - h->PointerToRawData < h->SizeOfRawData)
return log_error_status(EFI_LOAD_ERROR, "Invalid PE section, PointerToRawData + SizeOfRawData overflows");
if (h->PointerToRawData + h->SizeOfRawData > kernel->iov_len)
return log_error_status(EFI_LOAD_ERROR, "Invalid PE section, raw data extends outside of file");
memcpy(loaded_kernel + h->VirtualAddress,
(const uint8_t*)kernel->iov_base + h->PointerToRawData,
h->SizeOfRawData);