picnoir
/
Systemd
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

efivars: check path_len before using it as loop boundary

This commit is contained in:
David Tardon 2018-10-10 14:54:05 +02:00
parent c52368509f
commit e7e36b9030
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/shared/efivars.c
View File

@ -412,9 +412,13 @@ int efi_get_boot_option(
if (header->path_len > 0) {
uint8_t *dbuf;
size_t dnext;
size_t dnext, doff;
doff = offsetof(struct boot_option, title) + title_size;
dbuf = buf + doff;
if (header->path_len > l - doff)
return -EINVAL;
dbuf = buf + offsetof(struct boot_option, title) + title_size;
dnext = 0;
while (dnext < header->path_len) {
struct device_path *dpath;