Hi, On Wed, 08 Jul 2026 21:32:07 +0400, Alexey Charkov wrote: > When android_image_get_vendor_bootimg_size is called, its buffer is only > allocated with enough space for the bootconfig header, but the > android_vendor_boot_image_v3_v4_parse_hdr helper attempts to append a > bootconfig trailer to it, causing an out-of-bounds access and heap > corruption in some cases (e.g. triggered in sandbox test builds when > extra bootmeths are added, resulting in a segfault of the sandbox > process). > > [...]
Thanks, Applied to https://source.denx.de/u-boot/custodians/u-boot-dfu (u-boot-dfu) [1/1] boot: android: fix out-of-bounds access in bootconfig parsing https://source.denx.de/u-boot/custodians/u-boot-dfu/-/commit/ee3ab6988860d568b0ba0b568e57335cca2809d4 -- Mattijs
