From 40bc181f31be230de00f051789f49ac3ea0523fc Mon Sep 17 00:00:00 2001 From: Marc Hartmayer Date: Wed, 3 Dec 2025 14:03:19 +0100 Subject: [PATCH] zipl/boot: Fix out-of-bounds read if loadparm value is too large When a loadparm is presented by the user it's not checked whether it's too large. Add this missing check to fix an out-of-bounds read. The problem did not show up because the area behind the buffer is empty. Reviewed-by: Steffen Eiden Reviewed-by: Eduard Shishkin Signed-off-by: Marc Hartmayer Signed-off-by: Steffen Eiden --- zipl/boot/menu.c | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/zipl/boot/menu.c b/zipl/boot/menu.c index 6b5208ee..3daf73c0 100644 --- a/zipl/boot/menu.c +++ b/zipl/boot/menu.c @@ -196,13 +196,9 @@ int menu(void) value = menu_read(); - /* sanity - value too big */ - if (value > BOOT_MENU_ENTRIES) - panic(EINTERNAL, "%s", msg_econfig); - boot: /* sanity - config entry not valid */ - if (__stage2_params.config[value] == 0) + if (value > BOOT_MENU_ENTRIES || __stage2_params.config[value] == 0) panic(EINTERNAL, "%s", msg_econfig); printf("Booting %s\n",