On 2026-07-08T17:32:07, Alexey Charkov <[email protected]> wrote: > boot: android: fix out-of-bounds access in bootconfig parsing > > When android_image_get_vendor_bootimg_size is called, its buffer is only > allocated with enough space for the bootconfig header, but the > android_vendor_boot_image_v3_v4_parse_hdr helper attempts to append a > bootconfig trailer to it, causing an out-of-bounds access and heap > corruption in some cases (e.g. triggered in sandbox test builds when > extra bootmeths are added, resulting in a segfault of the sandbox > process). > > Skip the dangerous memcpy operations altogether when the > android_vendor_boot_image_v3_v4_parse_hdr helper is only called for size > calculation purposes, and only append the bootconfig trailer when called > from the actual bootconfig parsing code path. > > Fixes: 57e405e1f474 ("android: boot: support bootconfig") > Signed-off-by: Alexey Charkov <[email protected]> > > boot/image-android.c | 30 +++++++++++++++++++++--------- > 1 file changed, 21 insertions(+), 9 deletions(-)
Reviewed-by: Simon Glass <[email protected]>
