tree 99e25206ef738f37ae3db1ae4f06fd656602d382
parent 9493a9aece423b3044a845f7025b202ea08a8630
author Richard Weinberger <richard@nod.at> 1722442074 +0200
committer Tom Rini <trini@konsulko.com> 1723754131 -0600

bootstage: Fix out-of-bounds read in reloc_bootstage()

bootstage_get_size() returns the total size of the data structure
including associated records.
When copying from gd->bootstage, only the allocation size of gd->bootstage
must be used. Otherwise too much memory is copied.

This bug caused no harm so far because gd->new_bootstage is always
large enough and reading beyond the allocation length of gd->bootstage
caused no problem due to the U-Boot memory layout.

Fix by using the correct size and perform the initial copy directly
in bootstage_relocate() to have the whole relocation process in the
same function.

Signed-off-by: Richard Weinberger <richard@nod.at>
Reviewed-by: Simon Glass <sjg@chromium.org>