Merge tag 'u-boot-dfu-20260819' of https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu

u-boot-dfu-20260819

Android:
* Ensure boot image read is bound by partition size

1 files changed, 8 insertions, 0 deletions

diff --git a/boot/bootmeth_android.c b/boot/bootmeth_android.c
index ec255b072af..0db08d4f861 100644
--- a/boot/bootmeth_android.c
+++ b/boot/bootmeth_android.c
@@ -384,6 +384,14 @@ static int read_slotted_partition(struct blk_desc *desc, const char *const name,
 	if (ret < 0)
 		return log_msg_ret("part", ret);
 
+	/*
+	 * The image size comes from the (untrusted) boot image header, so bound
+	 * the read by the partition size: a valid image cannot be larger than
+	 * the partition holding it.
+	 */
+	if (num_blks > partition.size)
+		return log_msg_ret("image larger than partition", -EFBIG);
+
 	n = blk_dread(desc, partition.start, num_blks, map_sysmem(addr, 0));
 	if (n < num_blks)
 		return log_msg_ret("part read", -EIO);