Hi Alexey, Thank you for the patch.
On Wed, Jul 08, 2026 at 21:32, Alexey Charkov <[email protected]> wrote: > When android_image_get_vendor_bootimg_size is called, its buffer is only > allocated with enough space for the bootconfig header, but the > android_vendor_boot_image_v3_v4_parse_hdr helper attempts to append a > bootconfig trailer to it, causing an out-of-bounds access and heap > corruption in some cases (e.g. triggered in sandbox test builds when > extra bootmeths are added, resulting in a segfault of the sandbox > process). > > Skip the dangerous memcpy operations altogether when the > android_vendor_boot_image_v3_v4_parse_hdr helper is only called for size > calculation purposes, and only append the bootconfig trailer when called > from the actual bootconfig parsing code path. > > Fixes: 57e405e1f474 ("android: boot: support bootconfig") > Signed-off-by: Alexey Charkov <[email protected]> Reviewed-by: Mattijs Korpershoek <[email protected]> > ---
