kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zipl/src: Check file trailer

Browse Source 
Before extracting a file trailer, check that the file is big enough;
Check that signature length stored in the extracted trailer doesn't
exceed the size of the file without the trailer. Treat the case of
the failed checks as unsigned file.

Without the checks, memcmp() may read the area before the allocated
@buffer, dumping heap into bootmap or crashing.

Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Eduard Shishkin
2026-07-15 11:31:16 +02:00
committed by Jan Höppner
parent bd52e14740
commit 224e35b600
1 changed files with 5 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
zipl/src/bootmap.c
+5 -3
View File
@@ -616,17 +616,19 @@ extract_signature(const char *filename, void **ret_signature,
if (misc_read_file(filename, &buffer, &size, 0))
return 0;
if (size < sizeof(*file_sig))
goto out;
file_sig = (void *) buffer + size - sizeof(*file_sig);
if (memcmp(file_sig->magic, SIGNATURE_MAGIC, sizeof(file_sig->magic))
!= 0)
goto out;
if (file_sig->sig_len > size - sizeof(*file_sig))
/* Trailer is corrupted. Treated as unsigned file */
goto out;
signature = misc_malloc(file_sig->sig_len);
if (signature == NULL)
goto out;
signature_size = file_sig->sig_len;
memcpy(signature, buffer + size - signature_size - sizeof(*file_sig),
signature_size);