lkml.org 
[lkml]   [2012]   [Mar]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    Subject[patch v2] x86, efi: fix pointer math issue in handle_ramdisks()
    "filename" is a efi_char16_t string so this check for reaching the end
    of the array doesn't work. We need to cast the pointer to (u8 *) before
    doing the math.

    This patch changes the "filename" to "filename_16" to avoid confusion in
    the future.

    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    ---
    v2: Rename "filename" to "filename_16"
    Also changed cast from (char *) to (u8 *) because it's not a C
    character string. Ingo suggested (void *) but that's a GCCism
    I think.

    diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
    index fec216f..0cdfc0d 100644
    --- a/arch/x86/boot/compressed/eboot.c
    +++ b/arch/x86/boot/compressed/eboot.c
    @@ -539,7 +539,7 @@ static efi_status_t handle_ramdisks(efi_loaded_image_t *image,
    struct initrd *initrd;
    efi_file_handle_t *h;
    efi_file_info_t *info;
    - efi_char16_t filename[256];
    + efi_char16_t filename_16[256];
    unsigned long info_sz;
    efi_guid_t info_guid = EFI_FILE_INFO_ID;
    efi_char16_t *p;
    @@ -552,14 +552,14 @@ static efi_status_t handle_ramdisks(efi_loaded_image_t *image,
    str += 7;

    initrd = &initrds[i];
    - p = filename;
    + p = filename_16;

    /* Skip any leading slashes */
    while (*str == '/' || *str == '\\')
    str++;

    while (*str && *str != ' ' && *str != '\n') {
    - if (p >= filename + sizeof(filename))
    + if ((u8 *)p >= (u8 *)filename_16 + sizeof(filename_16))
    break;

    *p++ = *str++;
    @@ -583,7 +583,7 @@ static efi_status_t handle_ramdisks(efi_loaded_image_t *image,
    goto free_initrds;
    }

    - status = efi_call_phys5(fh->open, fh, &h, filename,
    + status = efi_call_phys5(fh->open, fh, &h, filename_16,
    EFI_FILE_MODE_READ, (u64)0);
    if (status != EFI_SUCCESS)
    goto close_handles;

    \
     
     \ /
      Last update: 2012-03-05 19:09    [W:3.262 / U:0.120 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site