From 8d58a9abb0604b27b673e11102c5f6c8049a8ab0 Mon Sep 17 00:00:00 2001 From: Marc Hartmayer Date: Thu, 4 Dec 2025 09:58:55 +0000 Subject: [PATCH] zipl/boot: Fix two off-by-one bugs Fix two off-by-one errors: + One caused an out-of-bounds read when the loadparm value was 63 + The other made a boot entry unselectable. Currently, these bugs have no practical impact because: 1. The memory area beyond __stage2_params.config[63] is empty. 2. BOOT_MENU_ENTRIES is set to 63, which exceeds the number of boot menu entries that can be written to disk. Reviewed-by: Mikhail Zaslonko Reviewed-by: Eduard Shishkin Signed-off-by: Marc Hartmayer Signed-off-by: Steffen Eiden --- zipl/boot/menu.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/zipl/boot/menu.c b/zipl/boot/menu.c index 3daf73c0..6d30cf81 100644 --- a/zipl/boot/menu.c +++ b/zipl/boot/menu.c @@ -61,7 +61,7 @@ static int menu_read(void) temp_area[i] = ebcdic_tolower(temp_area[i]); value = ebcdic_strtoul(temp_area, &endptr, 10); - if ((endptr != temp_area) && (value < BOOT_MENU_ENTRIES - 1) && + if ((endptr != temp_area) && (value < BOOT_MENU_ENTRIES) && (__stage2_params.config[value] != 0)) { /* valid config found - finish */ break; @@ -198,7 +198,7 @@ int menu(void) boot: /* sanity - config entry not valid */ - if (value > BOOT_MENU_ENTRIES || __stage2_params.config[value] == 0) + if (value >= BOOT_MENU_ENTRIES || __stage2_params.config[value] == 0) panic(EINTERNAL, "%s", msg_econfig); printf("Booting %s\n",