Repository navigation
Fix EFI to use HDR_CMDLINE only from the signed part of the manifest - #974
Conversation
There was a problem hiding this comment.
🟢 Approval recommended
No active review issues block approval of the EFI command-line boundary hardening.
No open issues 🎉
What changed in this PR
This PR hardens EFI command-line handling by accepting HDR_CMDLINE only when the complete TLV lies within the signed portion of the image manifest.
Changes:
- Rejects command lines that extend beyond the digest TLV boundary or lack a digest TLV.
- Adds unit tests for signed, unsigned, and absent command lines using a TLV-walking test helper.
| File | Description |
|---|---|
| tools/unit-tests/unit-efi-x86-open-image.c | Adds manifest fixtures, allocation mocking, and command-line validation tests. |
| include/wolfboot_efi.h | Enforces the signed-manifest boundary before returning an EFI command line. |
Review effort: Balanced
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #974
Scan targets checked: wolfboot-src, wolfboot-bugs
Coverage: 2 of 2 in-scope changed file(s) opened by the reviewer
Findings: 1
1 finding(s) posted as inline comments (see file-level comments below)
This review was generated automatically by Fenrir. Reported findings require changes before merge.
Review tier: Max
wolfSSL-Fenrir-bot
left a comment
wolfSSL-Fenrir-bot
left a comment
There was a problem hiding this comment.
Fenrir Automated Review — PR #974
Scan targets checked: wolfboot-src, wolfboot-bugs
Coverage: 1 of 1 in-scope changed file(s) opened by the reviewer
Fenrir result: Approved ✅
No new issues found in the changed files.
Advisory only — this automated result does not count as a GitHub approval.
Review tier: Lite
Fenrir's latest completed scan found no issues; clearing the prior automated change request.
wolfBoot_efi_get_cmdline()took the firstHDR_CMDLINETLV anywhere in the manifest, but the image signature covers the manifest only up to the digest TLV. It now uses the command line only when the whole TLV lies before the digest TLV, and returns none otherwise.unit-efi-x86-open-imagecovers both placements on a real TLV layout.