From: Heinrich Schuchardt Date: Wed, 11 Mar 2026 17:30:33 +0000 (+0100) Subject: efi_loader: avoid buffer overrun in efi_var_restore() X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=a9080e600c214bbff331f95136aa26e7cfbe3375;p=thirdparty%2Fu-boot.git efi_loader: avoid buffer overrun in efi_var_restore() The value of buf->length comes from outside U-Boot and may be incorrect. We must avoid to overrun our internal buffer for excessive values. If buf->length is shorter than the variable file header, the variable file is invalid. Reviewed-by: Ilias Apalodimas Tested-by: Michal Simek Signed-off-by: Heinrich Schuchardt --- diff --git a/lib/efi_loader/efi_var_common.c b/lib/efi_loader/efi_var_common.c index 5ea1688dca3..c89a4fce4ff 100644 --- a/lib/efi_loader/efi_var_common.c +++ b/lib/efi_loader/efi_var_common.c @@ -497,6 +497,8 @@ efi_status_t efi_var_restore(struct efi_var_file *buf, bool safe) efi_status_t ret; if (buf->reserved || buf->magic != EFI_VAR_FILE_MAGIC || + buf->length > EFI_VAR_BUF_SIZE || + buf->length < sizeof(struct efi_var_file) || buf->crc32 != crc32(0, (u8 *)buf->var, buf->length - sizeof(struct efi_var_file))) { log_err("Invalid EFI variables file\n");