diff options
| author | Kevin O'Connor <kevin@koconnor.net> | 2016-01-12 13:36:50 -0500 |
|---|---|---|
| committer | Kevin O'Connor <kevin@koconnor.net> | 2016-01-12 13:36:50 -0500 |
| commit | 3e8d75f3bef0f36a807303d58523ef5eba4a386f (patch) | |
| tree | a3baa6129e752f5c5bb62736efb609a36b5605b1 | |
| parent | 44250252eeaefd5e81bae2f73639bd323682217b (diff) | |
| download | seabios-hppa-3e8d75f3bef0f36a807303d58523ef5eba4a386f.zip seabios-hppa-3e8d75f3bef0f36a807303d58523ef5eba4a386f.tar.gz seabios-hppa-3e8d75f3bef0f36a807303d58523ef5eba4a386f.tar.bz2 | |
coreboot: Check for unaligned cbfs header
If the CBFS header is invalid and points to 0xffffffff it could cause
SeaBIOS to read past the 4GB boundary and cause an exception. Check
the alignment of the header pointer before attempting to access fields
within the header.
Reported-by: "Alex G." <mr.nuke.me@gmail.com>
Signed-off-by: Kevin O'Connor <kevin@koconnor.net>
| -rw-r--r-- | src/fw/coreboot.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/src/fw/coreboot.c b/src/fw/coreboot.c index 3b9df14..4fe1292 100644 --- a/src/fw/coreboot.c +++ b/src/fw/coreboot.c @@ -421,6 +421,10 @@ coreboot_cbfs_init(void) return; struct cbfs_header *hdr = *(void **)(CONFIG_CBFS_LOCATION - 4); + if ((u32)hdr & 0x03) { + dprintf(1, "Invalid CBFS pointer %p\n", hdr); + return; + } if (CONFIG_CBFS_LOCATION && (u32)hdr > CONFIG_CBFS_LOCATION) // Looks like the pointer is relative to CONFIG_CBFS_LOCATION hdr = (void*)hdr + CONFIG_CBFS_LOCATION; |