bootstage: Fix out-of-bounds read in reloc_bootstage()
bootstage_get_size() returns the total size of the data structure including associated records. When copying from gd->bootstage, only the allocation size of gd->bootstage must be used. Otherwise too much memory is copied. This bug caused no harm so far because gd->new_bootstage is always large enough and reading beyond the allocation length of gd->bootstage caused no problem due to the U-Boot memory layout. Fix by using the correct size and perform the initial copy directly in bootstage_relocate() to have the whole relocation process in the same function. Signed-off-by:Richard Weinberger <richard@nod.at> Reviewed-by:
Simon Glass <sjg@chromium.org>
Loading
Please register or sign in to comment