From bfc442ad18577c876292e10bbed0d40d421456dc Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Thu, 6 Aug 2026 15:41:35 +0100 Subject: [PATCH] [ucode] Remove harmless read beyond end of malformed equivalence table If the AMD microcode equivalence table is malformed and is not an exact multiple of the entry size, then we may read up to two bytes beyond the end of the allocated image. The small out-of-bounds read is harmless since the immediately following code will reject any image with fewer than eight bytes remaining after the equivalence table (or will harmlessly return immediately if the out-of-bounds read value was 0x00000000 and no previous equivalence table entries were present). Fix by adjusting the loop condition to ignore partial equivalence table entries. Signed-off-by: Michael Brown --- src/arch/x86/image/ucode.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/arch/x86/image/ucode.c b/src/arch/x86/image/ucode.c index fd4689e00..5fdc4cfdf 100644 --- a/src/arch/x86/image/ucode.c +++ b/src/arch/x86/image/ucode.c @@ -539,7 +539,8 @@ static int ucode_parse_amd ( struct image *image, size_t start, /* Count number of equivalence table entries */ offset = sizeof ( *hdr ); equiv = ( image->data + start + offset ); - for ( count = 0 ; offset < ( sizeof ( *hdr ) + hdr->len ) ; + for ( count = 0 ; + ( offset + sizeof ( *equiv ) ) <= ( sizeof ( *hdr ) + hdr->len ); count++, offset += sizeof ( *equiv ) ) { if ( ! equiv[count].signature ) break; -- 2.47.3