diff options
| -rw-r--r-- | boot/bootmeth_android.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/boot/bootmeth_android.c b/boot/bootmeth_android.c index ec255b072af..0db08d4f861 100644 --- a/boot/bootmeth_android.c +++ b/boot/bootmeth_android.c @@ -384,6 +384,14 @@ static int read_slotted_partition(struct blk_desc *desc, const char *const name, if (ret < 0) return log_msg_ret("part", ret); + /* + * The image size comes from the (untrusted) boot image header, so bound + * the read by the partition size: a valid image cannot be larger than + * the partition holding it. + */ + if (num_blks > partition.size) + return log_msg_ret("image larger than partition", -EFBIG); + n = blk_dread(desc, partition.start, num_blks, map_sysmem(addr, 0)); if (n < num_blks) return log_msg_ret("part read", -EIO); |