View | Details | Raw Unified | Return to bug 1215102
Collapse All | Expand All

(-)a/pe-relocate.c (-1 / +7 lines)
Lines 472-477 read_header(void *data, unsigned int datasize, Link Here
472
		return EFI_UNSUPPORTED;
472
		return EFI_UNSUPPORTED;
473
	}
473
	}
474
474
475
	if (checked_mul((size_t)context->NumberOfSections, sizeof(EFI_IMAGE_SECTION_HEADER), &tmpsz0) ||
476
	    checked_add(tmpsz0, SectionHeaderOffset, &tmpsz0) ||
477
	    (tmpsz0 > datasize)) {
478
		perror(L"Image sections overflow section headers\n");
479
		return EFI_UNSUPPORTED;
480
	}
481
475
	if (checked_sub((size_t)(uintptr_t)PEHdr, (size_t)(uintptr_t)data, &tmpsz0) ||
482
	if (checked_sub((size_t)(uintptr_t)PEHdr, (size_t)(uintptr_t)data, &tmpsz0) ||
476
	    checked_add(tmpsz0, sizeof(EFI_IMAGE_OPTIONAL_HEADER_UNION), &tmpsz0) ||
483
	    checked_add(tmpsz0, sizeof(EFI_IMAGE_OPTIONAL_HEADER_UNION), &tmpsz0) ||
477
	    (tmpsz0 > datasize)) {
484
	    (tmpsz0 > datasize)) {
478
- 

Return to bug 1215102