Re: [PATCH] efi_loader: Fix memory corruption on 32bit systems

Hi Dan

On Wed, 26 Jul 2023 at 09:55, Dan Carpenter dan.carpenter@linaro.org wrote:

It's pretty unlikely that anyone is going to be using EFI authentication on a 32bit system. However, if you did, the efi_prepare_aligned_image() function would write 8 bytes of data to the &efi_size variable and it can only hold 4 bytes so that corrupts memory.

Signed-off-by: Dan Carpenter dan.carpenter@linaro.org

lib/efi_loader/efi_image_loader.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/lib/efi_loader/efi_image_loader.c b/lib/efi_loader/efi_image_loader.c index 26df0da16c93..3d5eef7dc3c2 100644 --- a/lib/efi_loader/efi_image_loader.c +++ b/lib/efi_loader/efi_image_loader.c @@ -592,6 +592,7 @@ static bool efi_image_authenticate(void *efi, size_t efi_size) struct efi_signature_store *db = NULL, *dbx = NULL; void *new_efi = NULL; u8 *auth, *wincerts_end;

•   u64 size = efi_size;
    size_t auth_size;
    bool ret = false;
  
  

@@ -600,11 +601,11 @@ static bool efi_image_authenticate(void *efi, size_t efi_size) if (!efi_secure_boot_enabled()) return true;

•   new_efi = efi_prepare_aligned_image(efi, (u64 *)&efi_size);
  

Can't we change the prototype to access a size_t instead?

Cheers /Ilias

•   new_efi = efi_prepare_aligned_image(efi, &size);
    if (!new_efi)
            return false;
  
  

•   if (!efi_image_parse(new_efi, efi_size, &regs, &wincerts,
  

•   if (!efi_image_parse(new_efi, size, &regs, &wincerts,
                         &wincerts_len)) {
            log_err("Parsing PE executable image failed\n");
            goto out;
  

-- 2.39.2