Skip to content
Commit bdf5c1b3 authored by Stefan Brüns's avatar Stefan Brüns Committed by Alexander Graf
Browse files

efi_loader: Fix memory map size check to avoid out-of-bounds access



The current efi_get_memory_map() function overwrites the map_size
property before reading its value. That way the sanity check whether our
memory map fits into the given array always succeeds, potentially
overwriting arbitrary payload memory.

This patch moves the property update write after its sanity check, so
that the check actually verifies the correct value.

So far this has not triggered any known bugs, but we're better off safe
than sorry.

If the buffer is to small, the returned memory_map_size indicates the
required size to the caller.

Signed-off-by: default avatarStefan Brüns <stefan.bruens@rwth-aachen.de>
Reviewed-by: default avatarAlexander Graf <agraf@suse.de>
Signed-off-by: default avatarAlexander Graf <agraf@suse.de>
parent 852efbf5
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment