From c50e3d06841e979defd6fb081f7d3d7cc780811a Mon Sep 17 00:00:00 2001 From: bernard Date: Tue, 3 Nov 2026 07:17:49 +0800 Subject: [PATCH] [drivers][block] reject GPT entries with ending_lba before starting_lba is_pte_valid() accepted a GPT entry as long as both LBAs were inside the disk, so a crafted image could set ending_lba < starting_lba. The size computed in efi_partition() then underflowed to a huge value and was registered as the logical partition size. Reject entries whose end LBA is below the start LBA, and compute the partition start/size only after the entry passed validation. This avoids evaluating the underflow at all and reuses the validated start value for the size calculation. Fixes RT-Thread/rt-thread#11271. Co-authored-by: DeepSeek 4.1 Flash --- components/drivers/block/partitions/efi.c | 16 +++++++++++----- 1 file changed, 11 insertions(+), 5 deletions(-) diff --git a/components/drivers/block/partitions/efi.c b/components/drivers/block/partitions/efi.c index 522d5f6076bb..6d3ebf7f5313 100644 --- a/components/drivers/block/partitions/efi.c +++ b/components/drivers/block/partitions/efi.c @@ -545,9 +545,13 @@ static rt_bool_t is_gpt_valid(struct rt_blk_disk *disk, */ rt_inline rt_bool_t is_pte_valid(const gpt_entry *pte, const rt_size_t lastlba) { + rt_uint64_t start = rt_le64_to_cpu(pte->starting_lba); + rt_uint64_t end = rt_le64_to_cpu(pte->ending_lba); + if ((!efi_guidcmp(pte->partition_type_guid, NULL_GUID)) || - rt_le64_to_cpu(pte->starting_lba) > lastlba || - rt_le64_to_cpu(pte->ending_lba) > lastlba) + start > lastlba || + end > lastlba || + end < start) { return RT_FALSE; } @@ -823,15 +827,17 @@ rt_err_t efi_partition(struct rt_blk_disk *disk) for (int i = 0; i < entries_nr && i < disk->max_partitions; ++i) { - rt_uint64_t start = rt_le64_to_cpu(ptes[i].starting_lba); - rt_uint64_t size = rt_le64_to_cpu(ptes[i].ending_lba) - - rt_le64_to_cpu(ptes[i].starting_lba) + 1ULL; + rt_uint64_t start; + rt_uint64_t size; if (!is_pte_valid(&ptes[i], last_lba(disk))) { continue; } + start = rt_le64_to_cpu(ptes[i].starting_lba); + size = rt_le64_to_cpu(ptes[i].ending_lba) - start + 1ULL; + if (blk_put_partition(disk, "gpt", start, size, i) == -RT_ENOMEM) { break;