Skip to content
Commit 1779a58c authored by Richard Weinberger's avatar Richard Weinberger Committed by Tom Rini
Browse files

bootstage: Fix out-of-bounds read in reloc_bootstage()



bootstage_get_size() returns the total size of the data structure
including associated records.
When copying from gd->bootstage, only the allocation size of gd->bootstage
must be used. Otherwise too much memory is copied.

This bug caused no harm so far because gd->new_bootstage is always
large enough and reading beyond the allocation length of gd->bootstage
caused no problem due to the U-Boot memory layout.

Fix by using the correct size and perform the initial copy directly
in bootstage_relocate() to have the whole relocation process in the
same function.

Signed-off-by: default avatarRichard Weinberger <richard@nod.at>
Reviewed-by: default avatarSimon Glass <sjg@chromium.org>
parent faf73fb7
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment