From: Luca Boccassi <luca.boccassi@gmail.com>
Date: Fri, 26 Jun 2026 18:57:23 +0000 (+0100)
Subject: boot: reject inner kernel entry point outside the image
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=ecf3f5056a74058fc60de91a7784ab01ce27dec8;p=thirdparty%2Fsystemd.git

boot: reject inner kernel entry point outside the image

pe_kernel_info() returned AddressOfEntryPoint (and the .compat section
entry_point) straight from the PE header with no check against
SizeOfImage. Since cab9c7b5a4 the stub calls the inner kernel directly
as ImageBase + entry_point, and only EFI_SIZE_TO_PAGES(SizeOfImage) pages
are allocated for it.

Follow-up for cab9c7b5a42effa8a45611fc6b8556138c869b5f
---

diff --git a/src/boot/pe.c b/src/boot/pe.c
index 872cb9e6220..685812a488a 100644
--- a/src/boot/pe.c
+++ b/src/boot/pe.c
@@ -520,6 +520,10 @@ EFI_STATUS pe_kernel_info(
                 return EFI_UNSUPPORTED;
 
         if (pe->FileHeader.Machine == TARGET_MACHINE_TYPE) {
+                /* The entry point is later called as ImageBase + entry_point, and only SizeOfImage
+                 * bytes are allocated for the image, so reject an entry point outside of it. */
+                if (pe->OptionalHeader.AddressOfEntryPoint >= size_in_memory)
+                        return EFI_LOAD_ERROR;
                 if (ret_entry_point)
                         *ret_entry_point = pe->OptionalHeader.AddressOfEntryPoint;
                 if (ret_compat_entry_point)
@@ -535,6 +539,9 @@ EFI_STATUS pe_kernel_info(
         if (compat_entry_point == 0)
                 /* Image type not supported and no compat entry found. */
                 return EFI_UNSUPPORTED;
+        if (compat_entry_point >= size_in_memory)
+                /* Same as above: the compat entry point is called as ImageBase + entry_point. */
+                return EFI_LOAD_ERROR;
 
         if (ret_entry_point)
                 *ret_entry_point = 0;