diff options
| author | Heinrich Schuchardt <[email protected]> | 2026-06-30 01:35:13 +0200 |
|---|---|---|
| committer | Heinrich Schuchardt <[email protected]> | 2026-07-16 00:40:42 +0200 |
| commit | 8611cbc7916898e688b29207f53a47291eb8c2e4 (patch) | |
| tree | 153dfb6f3bb21609b4190c0372d4e90e0e197ed4 | |
| parent | 650dcf4520ac451db7a4dd3298034224181564e8 (diff) | |
efi_loader: fix buffer overrun in efi_sigstore_parse_siglist
In efi_sigstore_parse_siglist() sigdata is allocated. But instead of an
allocation matching the size of sigdata, tainted external data was used
to calculate the allocation size. This may lead to buffer overflows.
* Correct the allocation size.
* Follow the man-page. Use the structure size as second argument for
calloc.
Reviewed-by: Ilias Apalodimas <[email protected]>
Signed-off-by: Heinrich Schuchardt <[email protected]>
| -rw-r--r-- | lib/efi_loader/efi_signature.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/lib/efi_loader/efi_signature.c b/lib/efi_loader/efi_signature.c index 93a4f257016..f99a0c29d2b 100644 --- a/lib/efi_loader/efi_signature.c +++ b/lib/efi_loader/efi_signature.c @@ -703,8 +703,7 @@ efi_sigstore_parse_siglist(struct efi_signature_list *esl) goto err; } - sig_data = calloc(esl->signature_size - - sizeof(esd->signature_owner), 1); + sig_data = calloc(1, sizeof(*sig_data)); if (!sig_data) { EFI_PRINT("Out of memory\n"); goto err; |