On Fri, 18 Sep 2026 12:24:18 +0530, Pranav Sanwal wrote:
> bootm_os_get_boot_func() indexed boot_os[] with the caller-supplied os
> value without a bounds check. boot_os[] is sized by the highest
> enabled CONFIG_BOOTM_* entry, but images->os.os is an untrusted uint8_t
> populated from image metadata: a legacy uImage's raw ih_os byte, or a
> FIT image's os property truncated to 255 when its name is unrecognized
> by genimg_get_os_id(). An out-of-range value reads past the array and,
> if non-NULL, is invoked as a boot_os_fn.
>
> [...]
Applied to u-boot/next, thanks!
[1/1] bootm: bound-check OS id before indexing boot_os[]
commit: ed28577c31d895fa766ffb71ec1c35c4b39db2a7
--
Tom
