From 8edbba4cc48ea42978cd95de015170288b86c3c3 Mon Sep 17 00:00:00 2001 From: Jakub Czapiga Date: Thu, 9 Sep 2021 09:20:37 +0200 Subject: [PATCH] cbfs: Prevent overflow and infinite loop in cbfs_walk CBFS file with lenth of (UINT32_MAX - cbfs_file.offset + 1) causes overflow, making cbfs_walk() being stuck in an infinite loop, and checking the same file. This patch makes cbfs_walk() skip file headers with incorrect data_offset or data_length. Signed-off-by: Jakub Czapiga Change-Id: I70020e347087cbd8134a1a60177fa9eef63fb7bd Reviewed-on: https://review.coreboot.org/c/coreboot/+/57525 Tested-by: build bot (Jenkins) Reviewed-by: Julius Werner --- src/commonlib/bsd/cbfs_private.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/commonlib/bsd/cbfs_private.c b/src/commonlib/bsd/cbfs_private.c index 1642cca26a..94a29ac929 100644 --- a/src/commonlib/bsd/cbfs_private.c +++ b/src/commonlib/bsd/cbfs_private.c @@ -54,7 +54,8 @@ cb_err_t cbfs_walk(cbfs_dev_t dev, cb_err_t (*walker)(cbfs_dev_t dev, size_t off if (data_offset > sizeof(mdata) || data_length > devsize || offset + data_offset + data_length > devsize) { ERROR("File @%#zx too large\n", offset); - goto next_file; + offset += CBFS_ALIGNMENT; + continue; } if (empty && !(flags & CBFS_WALK_INCLUDE_EMPTY))