From mboxrd@z Thu Jan 1 00:00:00 1970 From: Alexander Graf Date: Thu, 13 Oct 2016 16:34:31 +0200 Subject: [U-Boot] [U-Boot, v4, 2/7] efi_loader: Fix memory map size check to avoid out-of-bounds access In-Reply-To: References: Message-ID: <20161013143430.34775.99400@achrid.arch.suse.de> List-Id: MIME-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit To: u-boot@lists.denx.de > The current efi_get_memory_map() function overwrites the map_size > property before reading its value. That way the sanity check whether our > memory map fits into the given array always succeeds, potentially > overwriting arbitrary payload memory. > > This patch moves the property update write after its sanity check, so > that the check actually verifies the correct value. > > So far this has not triggered any known bugs, but we're better off safe > than sorry. > > If the buffer is to small, the returned memory_map_size indicates the > required size to the caller. > > Signed-off-by: Stefan Br?ns > Reviewed-by: Alexander Graf Thanks, applied to