|
 |
4210fa |
From fa2a35ce78b3dc4e9b29f47a9ebc675a97a9a7c7 Mon Sep 17 00:00:00 2001
|
|
|
4210fa |
From: Peter Jones <pjones@redhat.com>
|
|
|
4210fa |
Date: Wed, 27 Aug 2014 16:39:51 -0400
|
|
|
4210fa |
Subject: [PATCH 54/74] Make sure we don't try to load a binary from a
|
|
|
4210fa |
different arch.
|
|
|
4210fa |
|
|
|
4210fa |
Since in theory you could, for example, get an x86_64 binary signed that
|
|
|
4210fa |
also behaves as an ARM executable, we should be checking this before
|
|
|
4210fa |
people build on other architectures.
|
|
|
4210fa |
|
|
|
4210fa |
Signed-off-by: Peter Jones <pjones@redhat.com>
|
|
|
4210fa |
---
|
|
|
4210fa |
include/PeImage.h | 1 +
|
|
|
4210fa |
shim.c | 19 +++++++++++++++++++
|
|
|
4210fa |
2 files changed, 20 insertions(+)
|
|
|
4210fa |
|
|
|
4210fa |
diff --git a/include/PeImage.h b/include/PeImage.h
|
|
|
4210fa |
index ec13404..133e11e 100644
|
|
|
4210fa |
--- a/include/PeImage.h
|
|
|
4210fa |
+++ b/include/PeImage.h
|
|
|
4210fa |
@@ -49,6 +49,7 @@ WITHOUT WARRANTIES OR REPRESENTATIONS OF ANY KIND, EITHER EXPRESS OR IMPLIED.
|
|
|
4210fa |
#define IMAGE_FILE_MACHINE_EBC 0x0EBC
|
|
|
4210fa |
#define IMAGE_FILE_MACHINE_X64 0x8664
|
|
|
4210fa |
#define IMAGE_FILE_MACHINE_ARMTHUMB_MIXED 0x01c2
|
|
|
4210fa |
+#define IMAGE_FILE_MACHINE_ARM64 0xaa64
|
|
|
4210fa |
|
|
|
4210fa |
//
|
|
|
4210fa |
// EXE file formats
|
|
|
4210fa |
diff --git a/shim.c b/shim.c
|
|
|
4210fa |
index 1329212..1ec1e11 100644
|
|
|
4210fa |
--- a/shim.c
|
|
|
4210fa |
+++ b/shim.c
|
|
|
4210fa |
@@ -947,6 +947,20 @@ static EFI_STATUS read_header(void *data, unsigned int datasize,
|
|
|
4210fa |
return EFI_SUCCESS;
|
|
|
4210fa |
}
|
|
|
4210fa |
|
|
|
4210fa |
+static const UINT16 machine_type =
|
|
|
4210fa |
+#if defined(__x86_64__)
|
|
|
4210fa |
+ IMAGE_FILE_MACHINE_X64;
|
|
|
4210fa |
+#elif defined(__aarch64__)
|
|
|
4210fa |
+ IMAGE_FILE_MACHINE_ARM64;
|
|
|
4210fa |
+#elif defined(__arm__)
|
|
|
4210fa |
+ IMAGE_FILE_MACHINE_ARMTHUMB_MIXED;
|
|
|
4210fa |
+#elif defined(__i386__) || defined(__i486__) || defined(__i686__)
|
|
|
4210fa |
+ IMAGE_FILE_MACHINE_I386;
|
|
|
4210fa |
+#elif defined(__ia64__)
|
|
|
4210fa |
+ IMAGE_FILE_MACHINE_IA64;
|
|
|
4210fa |
+#else
|
|
|
4210fa |
+#error this architecture is not supported by shim
|
|
|
4210fa |
+#endif
|
|
|
4210fa |
|
|
|
4210fa |
/*
|
|
|
4210fa |
* Once the image has been loaded it needs to be validated and relocated
|
|
|
4210fa |
@@ -971,6 +985,11 @@ static EFI_STATUS handle_image (void *data, unsigned int datasize,
|
|
|
4210fa |
return efi_status;
|
|
|
4210fa |
}
|
|
|
4210fa |
|
|
|
4210fa |
+ if (context.PEHdr->Pe32.FileHeader.Machine != machine_type) {
|
|
|
4210fa |
+ perror(L"Image is for a different architecture\n");
|
|
|
4210fa |
+ return EFI_UNSUPPORTED;
|
|
|
4210fa |
+ }
|
|
|
4210fa |
+
|
|
|
4210fa |
/*
|
|
|
4210fa |
* We only need to verify the binary if we're in secure mode
|
|
|
4210fa |
*/
|
|
|
4210fa |
--
|
|
|
4210fa |
1.9.3
|
|
|
4210fa |
|