Julius Werner has posted comments on this change. ( https://review.coreboot.org/c/coreboot/+/39033 )
Change subject: libpayload: Fix out-of-bounds read ......................................................................
Patch Set 4:
In this case, I was curious about coreboot and its secure boot implementation. Big fan of having easily auditable open source firmware!
Note that the core of the secure boot stuff is implemented in the separate "vboot" project, which is hosted at https://chromium.googlesource.com/chromiumos/platform/vboot_reference and checked out as a submodule under 3rdparty/vboot in your coreboot tree. It has a cleanly delimited API which might make it easier to analyze. Always appreciate extra eyes and analyzers on our code! (And if you do find something that's actually security-relevant, note that it might qualify for the rewards program at https://www.google.com/about/appsecurity/chrome-rewards/index.html.)