From 979c86f41201615df673ca051983618833396e9f Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Mon, 3 Aug 2026 12:24:08 +0100 Subject: [PATCH] [nbi] Avoid harmless integer overflows in image length checks Fix the checks against reading beyond the image length when executing an NBI image. This change has absolutely no security impact: an NBI image will obtain control of the system in ring 0 anyway, and so a "malicious" NBI image with malformed length fields cannot do anything that it would not already be able to do simply by being executed. However, fixing these harmless integer overflows costs very little and reduces unwanted noise from security reviewers. Signed-off-by: Michael Brown --- src/arch/x86/image/nbi.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/src/arch/x86/image/nbi.c b/src/arch/x86/image/nbi.c index e0a46758e..e3d9440e0 100644 --- a/src/arch/x86/image/nbi.c +++ b/src/arch/x86/image/nbi.c @@ -171,6 +171,11 @@ static int nbi_process_segments ( struct image *image, sh_off = NBI_LENGTH ( imgheader->length ); do { /* Read segment header */ + if ( ( sh_off + sizeof ( *sh ) ) > image->len ) { + DBGC ( image, "NBI %s segheader outside file\n", + image->name ); + return -ENOEXEC; + } sh = ( image->data + sh_off ); if ( sh->length == 0 ) { /* Avoid infinite loop? */ @@ -206,7 +211,8 @@ static int nbi_process_segments ( struct image *image, /* Process this segment */ filesz = sh->imglength; memsz = sh->memlength; - if ( ( offset + filesz ) > image->len ) { + if ( ( offset > image->len ) || + ( filesz > ( image->len - offset ) ) ) { DBGC ( image, "NBI %s segment outside file\n", image->name ); return -ENOEXEC; -- 2.47.3