On Wed, Jul 22, 2026 at 08:54, Mattijs Korpershoek via U-Boot <[email protected]> wrote:
> Hi, > > On Wed, 08 Jul 2026 21:32:07 +0400, Alexey Charkov wrote: >> When android_image_get_vendor_bootimg_size is called, its buffer is only >> allocated with enough space for the bootconfig header, but the >> android_vendor_boot_image_v3_v4_parse_hdr helper attempts to append a >> bootconfig trailer to it, causing an out-of-bounds access and heap >> corruption in some cases (e.g. triggered in sandbox test builds when >> extra bootmeths are added, resulting in a segfault of the sandbox >> process). >> >> [...] > > Thanks, Applied to https://source.denx.de/u-boot/custodians/u-boot-dfu > (u-boot-dfu) > > [1/1] boot: android: fix out-of-bounds access in bootconfig parsing > > https://source.denx.de/u-boot/custodians/u-boot-dfu/-/commit/ee3ab6988860d568b0ba0b568e57335cca2809d4 Also applied to new location: https://git.u-boot-project.org/u-boot/custodians/u-boot-dfu/-/commit/ee3ab6988860d568b0ba0b568e57335cca2809d4 > > -- > Mattijs
