Messages in this thread Patch in this message | | | Date | Tue, 28 Jul 2009 19:46:13 +0200 | From | Roel Kluin <> | Subject | [PATCH] x86: Buffer overflow |
| |
If the vendor name (from c16) can be longer than 100 bytes (or missing a terminating null), then the null is writen past the end of vendor[].
Signed-off-by: Roel Kluin <roel.kluin@gmail.com> --- Found with Parfait, http://research.sun.com/projects/parfait/
diff --git a/arch/x86/kernel/efi.c b/arch/x86/kernel/efi.c index 96f7ac0..436a42f 100644 --- a/arch/x86/kernel/efi.c +++ b/arch/x86/kernel/efi.c @@ -354,7 +354,7 @@ void __init efi_init(void) */ c16 = tmp = early_ioremap(efi.systab->fw_vendor, 2); if (c16) { - for (i = 0; i < sizeof(vendor) && *c16; ++i) + for (i = 0; i < sizeof(vendor) - 1 && *c16; ++i) vendor[i] = *c16++; vendor[i] = '\0'; } else
| |