picnoir/Systemd
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

systemd-boot: fix off-by-one buffer overrun

Browse source 
We'd allocate a buffer of some size and then write zero to the byte one after.
This commit is contained in:
Zbigniew Jędrzejewski-Szmek 2018-03-07 08:51:09 +01:00
parent 12643e7c43
commit 70756b3b4d
1 changed files with 2 additions and 3 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

5
src/boot/efi/util.c
View file

@ -327,16 +327,15 @@ EFI_STATUS file_read(EFI_FILE_HANDLE dir, CHAR16 *name, UINTN off, UINTN size, C
return err;
}
buf = AllocatePool(size);
buf = AllocatePool(size + 1);
err = uefi_call_wrapper(handle->Read, 3, handle, &size, buf);
if (!EFI_ERROR(err)) {
buf[size] = '\0';
*content = buf;
if (content_size)
*content_size = size;
} else {
} else
FreePool(buf);
}
uefi_call_wrapper(handle->Close, 1, handle);
return err;