From a8a87779c06515a227392e8cf777d6d2adb12fcf Mon Sep 17 00:00:00 2001 From: Mikhail Zaslonko Date: Thu, 2 Jul 2026 10:58:39 +0200 Subject: [PATCH] zdump/dfi_lkcd: Validate LKCD page address against mem_end MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit mem_init_flex() allocates the page header index array sized for ADDR_TO_IDX(mem_end) + 1 entries, but never checked that each page record's address falls within [0, mem_end). A crafted LKCD page record with addr >= mem_end writes 8 bytes beyond the allocation. Fix by rejecting any page record whose address is > mem_end - PAGE_SIZE with ERR_EXIT(), immediately after the end-of-dump marker check. Signed-off-by: Mikhail Zaslonko Reviewed-by: Alexander Egorenkov Signed-off-by: Jan Höppner --- zdump/dfi_lkcd.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/zdump/dfi_lkcd.c b/zdump/dfi_lkcd.c index f537b26f..77d4d3cb 100644 --- a/zdump/dfi_lkcd.c +++ b/zdump/dfi_lkcd.c @@ -225,6 +225,9 @@ static int mem_init_flex(void) } if (dump_end(addr, &pg_hdr)) break; + if (pg_hdr.addr + PAGE_SIZE > l.hdr.mem_end) + ERR_EXIT("Dump file inconsistent, LKCD page address out of range (0x%llx)", + pg_hdr.addr); if (pg_hdr.addr - addr > MEM_HOLE_SIZE_MIN) { dfi_mem_chunk_add(mem_chunk_start, addr + PAGE_SIZE - mem_chunk_start,