diff options
| author | You-Cheng Syu <youcheng@google.com> | 2019-02-27 15:29:15 +0800 |
|---|---|---|
| committer | Patrick Georgi <pgeorgi@google.com> | 2019-02-28 13:56:26 +0000 |
| commit | 5ec1d24974de8280a615047804bdfa73720777c8 (patch) | |
| tree | ad5dca182b1ffa2702a40357d6769509d5c8927b /payloads/libpayload/libcbfs/cbfs.c | |
| parent | 08087a3e8af00e423fe8df02ac658fb6a1f31f45 (diff) | |
| download | coreboot-5ec1d24974de8280a615047804bdfa73720777c8.tar.xz | |
libpayload: cbfs: Require input size and output size for cbfs_decompress
Currently, cbfs_decompress() calls ulzma() and ulz4f() for LZMA/LZ4
decompression. These two functions don't accept input/output size as
parameters. We can make cbfs_decompress more robust by calling ulzman()
and ulz4fn() instead. This could prevent us from overflowing destination
buffer.
BUG=none
BRANCH=none
TEST=boot into kernel on Kukui with COMPRESSED_PAYLOAD_LZMA /
COMPRESSED_PAYLOAD_LZ4.
Change-Id: Ibe617825bd000ed618791d8e3c5f65bbbd5f7e33
Signed-off-by: You-Cheng Syu <youcheng@google.com>
Reviewed-on: https://review.coreboot.org/c/31606
Tested-by: build bot (Jenkins) <no-reply@coreboot.org>
Reviewed-by: Julius Werner <jwerner@chromium.org>
Reviewed-by: Daisuke Nojiri <dnojiri@chromium.org>
Diffstat (limited to 'payloads/libpayload/libcbfs/cbfs.c')
| -rw-r--r-- | payloads/libpayload/libcbfs/cbfs.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/payloads/libpayload/libcbfs/cbfs.c b/payloads/libpayload/libcbfs/cbfs.c index 577fb2075a..d679e6708a 100644 --- a/payloads/libpayload/libcbfs/cbfs.c +++ b/payloads/libpayload/libcbfs/cbfs.c @@ -114,8 +114,9 @@ void * cbfs_load_stage(struct cbfs_media *media, const char *name) final_size = cbfs_decompress(stage->compression, ((unsigned char *) stage) + sizeof(struct cbfs_stage), + stage->len, (void *) (uintptr_t) stage->load, - stage->len); + stage->memlen); if (!final_size) { entry = -1; goto out; |