On Mon, 26 Oct 2026 at 15:19, Ana Bobillo <[email protected]> wrote: > > From: Ana Bobillo <[email protected]> > > efi_capsule_read_file() compares the size of the capsule file with the > capsule_image_size field of its header, but does not check that the > file holds a whole header first. A capsule file shorter than struct > efi_capsule_header makes it read past the end of the buffer it > allocated for the file. > > Reject a capsule file shorter than its header. > > Fixes: c74cd8bd08d1 ("efi_loader: capsule: add capsule_on_disk support") > Signed-off-by: Ana Bobillo <[email protected]> > ---
Reviewed-by: Ilias Apalodimas <[email protected]> > lib/efi_loader/efi_capsule.c | 2 +- > 1 file changed, 1 insertion(+), 1 deletion(-) > > diff --git a/lib/efi_loader/efi_capsule.c b/lib/efi_loader/efi_capsule.c > index a77810fa15c..54c118736cf 100644 > --- a/lib/efi_loader/efi_capsule.c > +++ b/lib/efi_loader/efi_capsule.c > @@ -1190,7 +1190,7 @@ static efi_status_t efi_capsule_read_file(const u16 > *filename, > /* fetch data */ > ret = EFI_CALL((*fh->read)(fh, &size, buf)); > if (ret == EFI_SUCCESS) { > - if (size >= buf->capsule_image_size) { > + if (size >= sizeof(*buf) && size >= buf->capsule_image_size) { > *capsule = buf; > } else { > free(buf);
