This fixes walking the cbfs file list because the bound checks do not apply to header components.
Output of coreboot's cbfstool: Name Offset Type Size Comp cbfs master header 0x0 cbfs header 32 none fallback/romstage 0x80 stage 21344 none fallback/ramstage 0x5440 stage 36848 none config 0xe480 raw 310 none revision 0xe600 raw 575 none fallback/bl31 0xe880 payload 15931 none fallback/payload 0x12700 payload 205449 none (empty) 0x44a00 null 111768 none header pointer 0x5fec0 cbfs header 4 none Output of u-boot's cbfsls: size type name ------------------------------------------ 32 cbfs header cbfs master header 21344 stage fallback/romstage 36848 stage fallback/ramstage 310 raw config 575 raw revision 15931 payload fallback/bl31 205449 payload fallback/payload 111768 null (empty) 4 cbfs header header pointer Signed-off-by: Andre Heider <a.hei...@gmail.com> --- cmd/cbfs.c | 3 +++ fs/cbfs/cbfs.c | 10 ++++++---- include/cbfs.h | 1 + 3 files changed, 10 insertions(+), 4 deletions(-) diff --git a/cmd/cbfs.c b/cmd/cbfs.c index 736f8c4527..f5ad04c45a 100644 --- a/cmd/cbfs.c +++ b/cmd/cbfs.c @@ -113,6 +113,9 @@ static int do_cbfs_ls(cmd_tbl_t *cmdtp, int flag, int argc, printf(" %8d", file_cbfs_size(file)); switch (type) { + case CBFS_COMPONENT_CBFSHEADER: + type_name = "cbfs header"; + break; case CBFS_TYPE_STAGE: type_name = "stage"; break; diff --git a/fs/cbfs/cbfs.c b/fs/cbfs/cbfs.c index 46da8f134f..389f60702b 100644 --- a/fs/cbfs/cbfs.c +++ b/fs/cbfs/cbfs.c @@ -97,10 +97,12 @@ static int file_cbfs_next_file(u8 *start, u32 size, u32 align, } swap_file_header(&header, fileHeader); - if (header.offset < sizeof(struct cbfs_fileheader) || - header.offset > header.len) { - file_cbfs_result = CBFS_BAD_FILE; - return -1; + if (header.type != CBFS_COMPONENT_CBFSHEADER) { + if (header.offset < sizeof(struct cbfs_fileheader) || + header.offset > header.len) { + file_cbfs_result = CBFS_BAD_FILE; + return -1; + } } newNode->next = NULL; newNode->type = header.type; diff --git a/include/cbfs.h b/include/cbfs.h index f50280107b..d5d9d8ce97 100644 --- a/include/cbfs.h +++ b/include/cbfs.h @@ -19,6 +19,7 @@ enum cbfs_result { }; enum cbfs_filetype { + CBFS_COMPONENT_CBFSHEADER = 0x02, CBFS_TYPE_STAGE = 0x10, CBFS_TYPE_PAYLOAD = 0x20, CBFS_TYPE_OPTIONROM = 0x30, -- 2.16.1 _______________________________________________ U-Boot mailing list U-Boot@lists.denx.de https://lists.denx.de/listinfo/u-boot