From 224e35b60017d3a5faf14699d230839169d8be62 Mon Sep 17 00:00:00 2001 From: Eduard Shishkin Date: Wed, 15 Jul 2026 11:31:16 +0200 Subject: [PATCH] zipl/src: Check file trailer MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Before extracting a file trailer, check that the file is big enough; Check that signature length stored in the extracted trailer doesn't exceed the size of the file without the trailer. Treat the case of the failed checks as unsigned file. Without the checks, memcmp() may read the area before the allocated @buffer, dumping heap into bootmap or crashing. Reviewed-by: Stefan Haberland Signed-off-by: Eduard Shishkin Signed-off-by: Jan Höppner --- zipl/src/bootmap.c | 8 +++++--- 1 file changed, 5 insertions(+), 3 deletions(-) diff --git a/zipl/src/bootmap.c b/zipl/src/bootmap.c index 78ff73aa..139dbfe0 100644 --- a/zipl/src/bootmap.c +++ b/zipl/src/bootmap.c @@ -616,17 +616,19 @@ extract_signature(const char *filename, void **ret_signature, if (misc_read_file(filename, &buffer, &size, 0)) return 0; - + if (size < sizeof(*file_sig)) + goto out; file_sig = (void *) buffer + size - sizeof(*file_sig); if (memcmp(file_sig->magic, SIGNATURE_MAGIC, sizeof(file_sig->magic)) != 0) goto out; - + if (file_sig->sig_len > size - sizeof(*file_sig)) + /* Trailer is corrupted. Treated as unsigned file */ + goto out; signature = misc_malloc(file_sig->sig_len); if (signature == NULL) goto out; signature_size = file_sig->sig_len; - memcpy(signature, buffer + size - signature_size - sizeof(*file_sig), signature_size);