Re: [PATCH] bootstd: android: bound the boot image read by its partition size

Hi Shahriyar,

Thank you for the patch.

On Wed, Jul 29, 2026 at 21:02, Shahriyar Jalayeri <[email protected]> wrote:

> read_slotted_partition() loads an Android boot/vendor_boot image into the
> load address, sizing the read from the image header:
>
> 	num_blks = DIV_ROUND_UP(image_size, desc->blksz);
> 	...
> 	blk_dread(desc, partition.start, num_blks, map_sysmem(addr, 0));
>
> image_size is priv->boot_img_size / priv->vendor_boot_img_size, taken from
> the boot image header and never bounded by the partition. A header
> claiming a size larger than the partition makes blk_dread read past the
> partition and write past the load buffer: an out-of-bounds write of
> attacker-controlled length on media a physical attacker can supply. It is
> reached during boot on a device where AVB does not gate the read (AVB
> disabled, or an unlocked device).
>
> Reject an image that does not fit in its partition before issuing the read.
> Both the boot and vendor_boot reads go through this function.
>
> Fixes: abadcda24b10 ("bootstd: android: don't read whole partition sizes")
> Signed-off-by: Shahriyar Jalayeri <[email protected]>

Reviewed-by: Mattijs Korpershoek <[email protected]>