From 1a150b2fe05627adc43cc00dd2291acfff30735a Mon Sep 17 00:00:00 2001 From: Marc Hartmayer Date: Mon, 23 Mar 2020 13:56:28 +0100 Subject: [PATCH] zipl/stage3: fix "off-by-two" errors MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 1. `begin` is used as array index and should therefore never be greater than COMMAND_LINE_SIZE - 1. Therefore let's fix the while condition. 2. `length` describes the string length and should therefore also never be greater than COMMAND_LINE_SIZE - 1. The 1. off-by-two error can lead to a out-of-bounds read and the 2. to a buffer overflow. Reviewed-by: Philipp Rudo Reviewed-by: Stefan Haberland Signed-off-by: Marc Hartmayer Signed-off-by: Jan Höppner --- zipl/boot/stage3.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/zipl/boot/stage3.c b/zipl/boot/stage3.c index e8ce9b71..418363bc 100644 --- a/zipl/boot/stage3.c +++ b/zipl/boot/stage3.c @@ -182,12 +182,12 @@ void start(void) /* Handle extra kernel parameters specified in DASD boot menu. */ ebcdic_to_ascii(cextra, cextra, COMMAND_LINE_SIZE); - /* remove leading whitespace */ - while (begin <= COMMAND_LINE_SIZE && cextra[begin] == 0x20) + /* remove leading whitespace of extra parameter */ + while (begin < COMMAND_LINE_SIZE - 1 && cextra[begin] == 0x20) begin++; /* determine length of extra parameter */ - while (length <= COMMAND_LINE_SIZE && cextra[length] != 0) + while (length < COMMAND_LINE_SIZE - 1 && cextra[length] != 0) length++; /* find end of original parm line */