kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zipl/stage3: fix "off-by-two" errors

Browse Source 
1. `begin` is used as array index and should therefore never be greater
    than COMMAND_LINE_SIZE - 1. Therefore let's fix the while condition.

2. `length` describes the string length and should therefore also never
    be greater than COMMAND_LINE_SIZE - 1.

The 1. off-by-two error can lead to a out-of-bounds read and the 2.
to a buffer overflow.

Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2020-03-23 13:56:28 +01:00
committed by Jan Höppner
parent 0843b7db36
commit 1a150b2fe0
1 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
zipl/boot/stage3.c
View File

@@ -182,12 +182,12 @@ void start(void)
/* Handle extra kernel parameters specified in DASD boot menu. */
ebcdic_to_ascii(cextra, cextra, COMMAND_LINE_SIZE);
/* remove leading whitespace */
while (begin <= COMMAND_LINE_SIZE && cextra[begin] == 0x20)
/* remove leading whitespace of extra parameter */
while (begin < COMMAND_LINE_SIZE - 1 && cextra[begin] == 0x20)
begin++;
/* determine length of extra parameter */
while (length <= COMMAND_LINE_SIZE && cextra[length] != 0)
while (length < COMMAND_LINE_SIZE - 1 && cextra[length] != 0)
length++;
/* find end of original parm line */