[nbi] Avoid harmless integer overflows in image length checks

Fix the checks against reading beyond the image length when executing
an NBI image.

This change has absolutely no security impact: an NBI image will
obtain control of the system in ring 0 anyway, and so a "malicious"
NBI image with malformed length fields cannot do anything that it
would not already be able to do simply by being executed.  However,
fixing these harmless integer overflows costs very little and reduces
unwanted noise from security reviewers.

Signed-off-by: Michael Brown <mcb30@ipxe.org>

diff --git a/src/arch/x86/image/nbi.c b/src/arch/x86/image/nbi.c
index e0a46758eae783ad40dcec71c16919face45a8c5..e3d9440e0f751102ecc7e47d83e312b188ef859e 100644 (file)
--- a/src/arch/x86/image/nbi.c
+++ b/src/arch/x86/image/nbi.c
@@ -171,6 +171,11 @@ static int nbi_process_segments ( struct image *image,
        sh_off = NBI_LENGTH ( imgheader->length );
        do {
                /* Read segment header */
+               if ( ( sh_off + sizeof ( *sh ) ) > image->len ) {
+                       DBGC ( image, "NBI %s segheader outside file\n",
+                              image->name );
+                       return -ENOEXEC;
+               }
                sh = ( image->data + sh_off );
                if ( sh->length == 0 ) {
                        /* Avoid infinite loop? */
@@ -206,7 +211,8 @@ static int nbi_process_segments ( struct image *image,
                /* Process this segment */
                filesz = sh->imglength;
                memsz = sh->memlength;
-               if ( ( offset + filesz ) > image->len ) {
+               if ( ( offset > image->len ) ||
+                    ( filesz > ( image->len - offset ) ) ) {
                        DBGC ( image, "NBI %s segment outside file\n",
                               image->name );
                        return -ENOEXEC;