From: Ana Bobillo <[email protected]>
efi_load_pe() copies each section from PointerToRawData in the image
without checking that the copied bytes lie within the image, so a
section pointing near or past the end of the image is read out of
bounds.
Reject a section whose raw data does not lie within the image before the
image is allocated, also when VirtualSize is smaller and only part of
the raw data is copied. barebox, whose EFI loader is based on this file,
checks the copied part since 552a54e4d357 ("efi: loader: validate
section raw data bounds against image size").
This runs before the image is rejected when Secure Boot fails to verify
it.
Fixes: cb149c66342c ("efi_loader: Add PE image loader")
Signed-off-by: Ana Bobillo <[email protected]>
---
lib/efi_loader/efi_image_loader.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/lib/efi_loader/efi_image_loader.c
b/lib/efi_loader/efi_image_loader.c
index b21947e979a..c6e7d5fc599 100644
--- a/lib/efi_loader/efi_image_loader.c
+++ b/lib/efi_loader/efi_image_loader.c
@@ -1062,6 +1062,13 @@ efi_status_t efi_load_pe(struct efi_loaded_image_obj
*handle,
return EFI_LOAD_ERROR;
}
+ /* The raw data of the section must lie within the image */
+ if (!pe_range_ok(efi_size, sec->PointerToRawData,
+ sec->SizeOfRawData)) {
+ log_err("Section %d exceeds image size\n", i);
+ return EFI_LOAD_ERROR;
+ }
+
virt_size = max_t(unsigned long, virt_size, end);
}
