SymbX/systemd
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

boot: reject inner kernel entry point outside the image

Browse Source 
pe_kernel_info() returned AddressOfEntryPoint (and the .compat section
entry_point) straight from the PE header with no check against
SizeOfImage. Since cab9c7b5a4 the stub calls the inner kernel directly
as ImageBase + entry_point, and only EFI_SIZE_TO_PAGES(SizeOfImage) pages
are allocated for it.

Follow-up for cab9c7b5a4
This commit is contained in:
Luca Boccassi
2026-07-03 15:19:39 +01:00
parent 7378b51f66
commit ecf3f5056a
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/boot/pe.c
+7
View File
@@ -520,6 +520,10 @@ EFI_STATUS pe_kernel_info(
return EFI_UNSUPPORTED;
if (pe->FileHeader.Machine == TARGET_MACHINE_TYPE) {
/* The entry point is later called as ImageBase + entry_point, and only SizeOfImage
* bytes are allocated for the image, so reject an entry point outside of it. */
if (pe->OptionalHeader.AddressOfEntryPoint >= size_in_memory)
return EFI_LOAD_ERROR;
if (ret_entry_point)
*ret_entry_point = pe->OptionalHeader.AddressOfEntryPoint;
if (ret_compat_entry_point)
@@ -535,6 +539,9 @@ EFI_STATUS pe_kernel_info(
if (compat_entry_point == 0)
/* Image type not supported and no compat entry found. */
return EFI_UNSUPPORTED;
if (compat_entry_point >= size_in_memory)
/* Same as above: the compat entry point is called as ImageBase + entry_point. */
return EFI_LOAD_ERROR;
if (ret_entry_point)
*ret_entry_point = 0;