On 2026-06-19T14:45:51, Aristo Chen <[email protected]> wrote: > bootm: move OS index bound check into the legacy path > > Commit 103b1e7ce8cc ("bootm: bound-check OS index in > bootm_os_get_boot_func()") added a range check to the shared accessor so > an out-of-range OS id can no longer drive an out-of-bounds read of > boot_os[]. That accessor is reached by every image format, but only a > legacy uImage can deliver an unchecked value. bootm_find_os() takes the > raw 8-bit ih_os byte straight from image_get_os() for legacy images, > whereas the FIT path reaches the accessor only after fit_image_load() > has rejected any image whose os is not one of the supported types, and > the Android path hardcodes IH_OS_LINUX. The check can therefore never > fail for FIT, where it only adds confusion and code. > > Move the test to the legacy branch of bootm_find_os(), rejecting an > out-of-range OS where the untrusted byte enters. This keeps the FIT path > clear and lets the check be compiled out when CONFIG_LEGACY_IMAGE_FORMAT > is disabled. A valid OS id that has no handler is still reported by the > existing NULL return path in bootm_run_states(). > > Suggested-by: Simon Glass <[email protected]> > Signed-off-by: Aristo Chen <[email protected]> > > boot/bootm.c | 4 ++++ > boot/bootm_os.c | 2 -- > 2 files changed, 4 insertions(+), 2 deletions(-)
Reviewed-by: Simon Glass <[email protected]>
