On 10/30/26 07:14, Ana Bobillo wrote:
From: Ana Bobillo <[email protected]>
efi_load_pe() copies each section from PointerToRawData in the image
without checking that the copied bytes lie within the image, so a
section pointing near or past the end of the image is read out of
bounds.
Reject such a section before the image is allocated, as barebox, whose
EFI loader is based on this file, does since 552a54e4d357 ("efi: loader:
validate section raw data bounds against image size").
This runs before the image is rejected when Secure Boot fails to verify
it.
Fixes: cb149c66342c ("efi_loader: Add PE image loader")
Signed-off-by: Ana Bobillo <[email protected]>
---
lib/efi_loader/efi_image_loader.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/lib/efi_loader/efi_image_loader.c
b/lib/efi_loader/efi_image_loader.c
index b15a662e5d6..7fd03ac6211 100644
--- a/lib/efi_loader/efi_image_loader.c
+++ b/lib/efi_loader/efi_image_loader.c
@@ -1075,6 +1075,13 @@ efi_status_t efi_load_pe(struct efi_loaded_image_obj
*handle,
return EFI_LOAD_ERROR;
}
+ /* The data copied for the section must lie within the image */
+ if (!pe_range_ok(efi_size, sec->PointerToRawData,
+ min(section_size(sec), sec->SizeOfRawData))) {
All of raw data should be inside the image even if VirtualSize <
SizeOfRawData.
Best regards
Heinrich
+ log_err("Section %d exceeds image size\n", i);
+ return EFI_LOAD_ERROR;
+ }
+
virt_size = max_t(unsigned long, virt_size, end);
}
