boot: reject inner kernel entry point outside the image

pe_kernel_info() returned AddressOfEntryPoint (and the .compat section
entry_point) straight from the PE header with no check against
SizeOfImage. Since cab9c7b5a4 the stub calls the inner kernel directly
as ImageBase + entry_point, and only EFI_SIZE_TO_PAGES(SizeOfImage) pages
are allocated for it.

Follow-up for cab9c7b5a42effa8a45611fc6b8556138c869b5f

diff --git a/src/boot/pe.c b/src/boot/pe.c
index 872cb9e6220e43bf25254b44fca6f3ddd157fa07..685812a488a3e678941266f92a052a91973a1162 100644 (file)
--- a/src/boot/pe.c
+++ b/src/boot/pe.c
@@ -520,6 +520,10 @@ EFI_STATUS pe_kernel_info(
                 return EFI_UNSUPPORTED;
 
         if (pe->FileHeader.Machine == TARGET_MACHINE_TYPE) {
+                /* The entry point is later called as ImageBase + entry_point, and only SizeOfImage
+                 * bytes are allocated for the image, so reject an entry point outside of it. */
+                if (pe->OptionalHeader.AddressOfEntryPoint >= size_in_memory)
+                        return EFI_LOAD_ERROR;
                 if (ret_entry_point)
                         *ret_entry_point = pe->OptionalHeader.AddressOfEntryPoint;
                 if (ret_compat_entry_point)
@@ -535,6 +539,9 @@ EFI_STATUS pe_kernel_info(
         if (compat_entry_point == 0)
                 /* Image type not supported and no compat entry found. */
                 return EFI_UNSUPPORTED;
+        if (compat_entry_point >= size_in_memory)
+                /* Same as above: the compat entry point is called as ImageBase + entry_point. */
+                return EFI_LOAD_ERROR;
 
         if (ret_entry_point)
                 *ret_entry_point = 0;