diff options
| author | Heinrich Schuchardt <heinrich.schuchardt@canonical.com> | 2023-02-13 19:22:33 +0100 |
|---|---|---|
| committer | Heinrich Schuchardt <heinrich.schuchardt@canonical.com> | 2023-02-19 21:15:15 +0100 |
| commit | 67af329a741b546986be2f3b18933f8c8b373bed (patch) | |
| tree | 714096371059d0da561924d71d605cbf99c373fc | |
| parent | 093ff96e741d5754e2c895a367fce06ae4464d16 (diff) | |
| download | u-boot-67af329a741b546986be2f3b18933f8c8b373bed.zip u-boot-67af329a741b546986be2f3b18933f8c8b373bed.tar.gz u-boot-67af329a741b546986be2f3b18933f8c8b373bed.tar.bz2 | |
efi_loader: avoid buffer overrun in efi_var_mem_compare
We should not scan beyond the end of string name.
Signed-off-by: Heinrich Schuchardt <heinrich.schuchardt@canonical.com>
| -rw-r--r-- | lib/efi_loader/efi_var_mem.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/lib/efi_loader/efi_var_mem.c b/lib/efi_loader/efi_var_mem.c index e1058e3..d6b65ae 100644 --- a/lib/efi_loader/efi_var_mem.c +++ b/lib/efi_loader/efi_var_mem.c @@ -41,11 +41,13 @@ efi_var_mem_compare(struct efi_var_entry *var, const efi_guid_t *guid, i < sizeof(efi_guid_t) && match; ++i) match = (guid1[i] == guid2[i]); - for (data = var->name, var_name = name;; ++data, ++var_name) { + for (data = var->name, var_name = name;; ++data) { if (match) match = (*data == *var_name); if (!*data) break; + if (*var_name) + ++var_name; } ++data; |