[astro] 31.20260429.103.9300 u-boot source

GitOrigin-RevId: d561e736e39f60bd52ec4baae4358a7f0efedbdc
Change-Id: I8755e8268aad1f0af3fcb5cbb44e70310cd3e4db
Reviewed-on: https://turquoise-internal-review.googlesource.com/c/third_party/u-boot/+/1649101
Reviewed-by: David Pursell <dpursell@google.com>

board/amlogic/g12a_estelle_bx/zircon.c

diff --git a/board/amlogic/g12a_estelle_bx/zircon.c b/board/amlogic/g12a_estelle_bx/zircon.c
index 2d3052d..db69fd1 100644
--- a/board/amlogic/g12a_estelle_bx/zircon.c
+++ b/board/amlogic/g12a_estelle_bx/zircon.c
@@ -601,6 +601,24 @@
 		       (size_t)(payload_start - payload_padding_start));
 	}
 
+	/* If any files failed to load, shrink `dirsize` accordingly to trim off
+	 * the parts of the buffer that never got filled. This may leave an unused
+	 * gap between the end of the directory entries and the payload start, but
+	 * this is fine because offsets are all based from the header start, nothing
+	 * is relative to the directory entries end.
+	 *
+	 *              | <--   dirsize   --> |
+	 *     | header | dirent1 ... direntN | unused | payload1 ... payloadN |
+	 *     ^                              ^
+	 * header_start                  entry_ptr
+	 */
+	dirsize = (uint32_t)(entry_ptr -
+			     (header_start + sizeof(zbi_bootfs_header_t)));
+	if (dirsize < bootfs_header->dirsize) {
+		uint32_t unused_size = bootfs_header->dirsize - dirsize;
+		bootfs_header->dirsize = dirsize;
+		memset(entry_ptr, 0, unused_size);
+	}
 	*bootfs_size = data_off;
 	return 0;
 }

lib/fuchsia/pkg/zbi/zbi.c

diff --git a/lib/fuchsia/pkg/zbi/zbi.c b/lib/fuchsia/pkg/zbi/zbi.c
index 630ffed..027d437 100644
--- a/lib/fuchsia/pkg/zbi/zbi.c
+++ b/lib/fuchsia/pkg/zbi/zbi.c
@@ -139,6 +139,10 @@
   const uint32_t totalSize = (uint32_t)sizeof(zbi_header_t) + header->length;
   uint32_t offset = sizeof(zbi_header_t);
   while (offset < totalSize) {
+    if (offset + sizeof(zbi_header_t) > totalSize) {
+      return ZBI_RESULT_ERR_TRUNCATED;
+    }
+
     zbi_header_t* entryHeader = (zbi_header_t*)(base + offset);
 
     zbi_result_t result = callback(entryHeader, entryHeader + 1, cookie);