bootm_os_get_boot_func() indexed boot_os[] with the caller-supplied os value without a bounds check. boot_os[] is sized by the highest enabled CONFIG_BOOTM_* entry, but images->os.os is an untrusted uint8_t populated from image metadata: a legacy uImage's raw ih_os byte, or a FIT image's os property truncated to 255 when its name is unrecognized by genimg_get_os_id(). An out-of-range value reads past the array and, if non-NULL, is invoked as a boot_os_fn.
Return NULL for out-of-range indices so the existing "not supported" error path in bootm_run_states() handles it. Signed-off-by: Pranav Sanwal <[email protected]> --- boot/bootm_os.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/boot/bootm_os.c b/boot/bootm_os.c index 88f7c183867..cf67419c04c 100644 --- a/boot/bootm_os.c +++ b/boot/bootm_os.c @@ -599,5 +599,8 @@ int boot_selected_os(int state, struct bootm_info *bmi, boot_os_fn *boot_fn) boot_os_fn *bootm_os_get_boot_func(int os) { + if (os < 0 || os >= ARRAY_SIZE(boot_os)) + return NULL; + return boot_os[os]; } -- 2.43.7
