shaba/systemd
1
0
Fork 0
mirror of https://github.com/systemd/systemd.git synced 2025-02-13 01:57:42 +03:00
Code

systemd-boot: fix off-by-one buffer overrun

Browse Source 
We'd allocate a buffer of some size and then write zero to the byte one after.
This commit is contained in:
Zbigniew Jędrzejewski-Szmek 2018-03-07 08:51:09 +01:00
parent 12643e7c43
commit 70756b3b4d
1 changed files with 2 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/boot/efi/util.c
View File

@ -327,16 +327,15 @@ EFI_STATUS file_read(EFI_FILE_HANDLE dir, CHAR16 *name, UINTN off, UINTN size, C
return err; return err;
} }
buf = AllocatePool(size); buf = AllocatePool(size + 1);
err = uefi_call_wrapper(handle->Read, 3, handle, &size, buf); err = uefi_call_wrapper(handle->Read, 3, handle, &size, buf);
if (!EFI_ERROR(err)) { if (!EFI_ERROR(err)) {
buf[size] = '\0'; buf[size] = '\0';
*content = buf; *content = buf;
if (content_size) if (content_size)
*content_size = size; *content_size = size;
} else { } else
FreePool(buf); FreePool(buf);
}
uefi_call_wrapper(handle->Close, 1, handle); uefi_call_wrapper(handle->Close, 1, handle);
return err; return err;