From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Fri, 26 Jun 2026 16:15:38 +0000 (+0100)
Subject: boot: reject GPT headers with SizeOfPartitionEntry below the minimum
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=d06d8a232bf8ff4b27e4b5326dcec9717d89f3bc;p=thirdparty%2Fsystemd.git

boot: reject GPT headers with SizeOfPartitionEntry below the minimum

Commit 0cf5f816f22c replaced the original lower-bound check

    if (h->SizeOfPartitionEntry < sizeof(EFI_PARTITION_ENTRY))
            return false;

with a multiple-of check

    if ((h->SizeOfPartitionEntry % sizeof(EFI_PARTITION_ENTRY)) != 0)
            return false;

to additionally require the entry size to be a multiple of 128. The
modulo test is however also satisfied by SizeOfPartitionEntry == 0, so a
GPT header advertising a zero entry size now passes verify_gpt().

Restore the lower bound in addition to the multiple-of check, so the
entry size must be at least sizeof(EFI_PARTITION_ENTRY) and a multiple of
it (128 bytes).

Follow-up for 0cf5f816f22c78740e122dfb6b3942ba4241717b
---

diff --git a/src/boot/part-discovery.c b/src/boot/part-discovery.c
index ab553a6530b..10ba5241254 100644
--- a/src/boot/part-discovery.c
+++ b/src/boot/part-discovery.c
@@ -60,7 +60,8 @@ static bool verify_gpt(/* const */ GptHeader *h, EFI_LBA lba_expected) {
         if (h->MyLBA != lba_expected)
                 return false;
 
-        if ((h->SizeOfPartitionEntry % sizeof(EFI_PARTITION_ENTRY)) != 0)
+        if (h->SizeOfPartitionEntry < sizeof(EFI_PARTITION_ENTRY) ||
+            (h->SizeOfPartitionEntry % sizeof(EFI_PARTITION_ENTRY)) != 0)
                 return false;
 
         if (h->NumberOfPartitionEntries <= 0 || h->NumberOfPartitionEntries > 1024)