efi_loader: avoid buffer overrun in efi_var_restore()

The value of buf->length comes from outside U-Boot and may be incorrect.
We must avoid to overrun our internal buffer for excessive values.

If buf->length is shorter than the variable file header, the variable
file is invalid.

Reviewed-by: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Tested-by: Michal Simek <michal.simek@amd.com>
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>

diff --git a/lib/efi_loader/efi_var_common.c b/lib/efi_loader/efi_var_common.c
index 5ea1688dca3dcdc81c911fc87a1cd4459331ec28..c89a4fce4ff8782c2448e43d0905215a9d999277 100644 (file)
--- a/lib/efi_loader/efi_var_common.c
+++ b/lib/efi_loader/efi_var_common.c
@@ -497,6 +497,8 @@ efi_status_t efi_var_restore(struct efi_var_file *buf, bool safe)
        efi_status_t ret;
 
        if (buf->reserved || buf->magic != EFI_VAR_FILE_MAGIC ||
+           buf->length > EFI_VAR_BUF_SIZE ||
+           buf->length < sizeof(struct efi_var_file) ||
            buf->crc32 != crc32(0, (u8 *)buf->var,
                                buf->length - sizeof(struct efi_var_file))) {
                log_err("Invalid EFI variables file\n");