[PATCH v2 1/7] efi_loader: capsule: check the size of a capsule file

[Ana Bobillo]

From: Ana Bobillo <anabobil...@gmail.com>

efi_capsule_read_file() compares the size of the capsule file with the
capsule_image_size field of its header, but does not check that the
file holds a whole header first. A capsule file shorter than struct
efi_capsule_header makes it read past the end of the buffer it
allocated for the file.

Reject a capsule file shorter than its header.

Fixes: c74cd8bd08d1 ("efi_loader: capsule: add capsule_on_disk support")
Signed-off-by: Ana Bobillo <anabobil...@gmail.com>
Reviewed-by: Ilias Apalodimas <ilias.apalodi...@linaro.org>
---
 lib/efi_loader/efi_capsule.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/efi_loader/efi_capsule.c b/lib/efi_loader/efi_capsule.c
index a77810fa15c..54c118736cf 100644
--- a/lib/efi_loader/efi_capsule.c
+++ b/lib/efi_loader/efi_capsule.c
@@ -1190,7 +1190,7 @@ static efi_status_t efi_capsule_read_file(const u16 
*filename,
        /* fetch data */
        ret = EFI_CALL((*fh->read)(fh, &size, buf));
        if (ret == EFI_SUCCESS) {
-               if (size >= buf->capsule_image_size) {
+               if (size >= sizeof(*buf) && size >= buf->capsule_image_size) {
                        *capsule = buf;
                } else {
                        free(buf);