Hi Dan On Wed, 26 Jul 2023 at 09:55, Dan Carpenter <dan.carpen...@linaro.org> wrote: > > It's pretty unlikely that anyone is going to be using EFI authentication > on a 32bit system. However, if you did, the efi_prepare_aligned_image() > function would write 8 bytes of data to the &efi_size variable and it > can only hold 4 bytes so that corrupts memory. > > Signed-off-by: Dan Carpenter <dan.carpen...@linaro.org> > --- > lib/efi_loader/efi_image_loader.c | 5 +++-- > 1 file changed, 3 insertions(+), 2 deletions(-) > > diff --git a/lib/efi_loader/efi_image_loader.c > b/lib/efi_loader/efi_image_loader.c > index 26df0da16c93..3d5eef7dc3c2 100644 > --- a/lib/efi_loader/efi_image_loader.c > +++ b/lib/efi_loader/efi_image_loader.c > @@ -592,6 +592,7 @@ static bool efi_image_authenticate(void *efi, size_t > efi_size) > struct efi_signature_store *db = NULL, *dbx = NULL; > void *new_efi = NULL; > u8 *auth, *wincerts_end; > + u64 size = efi_size; > size_t auth_size; > bool ret = false; > > @@ -600,11 +601,11 @@ static bool efi_image_authenticate(void *efi, size_t > efi_size) > if (!efi_secure_boot_enabled()) > return true; > > - new_efi = efi_prepare_aligned_image(efi, (u64 *)&efi_size);
Can't we change the prototype to access a size_t instead? Cheers /Ilias > + new_efi = efi_prepare_aligned_image(efi, &size); > if (!new_efi) > return false; > > - if (!efi_image_parse(new_efi, efi_size, ®s, &wincerts, > + if (!efi_image_parse(new_efi, size, ®s, &wincerts, > &wincerts_len)) { > log_err("Parsing PE executable image failed\n"); > goto out; > -- > 2.39.2 >