kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zipl/boot: Fix out-of-bounds read if loadparm value is too large

Browse Source 
When a loadparm is presented by the user it's not checked whether it's
too large. Add this missing check to fix an out-of-bounds read.

The problem did not show up because the area behind the buffer is empty.

Reviewed-by: Steffen Eiden <seiden@linux.ibm.com>
Reviewed-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2025-12-03 14:03:19 +01:00
committed by Steffen Eiden
parent a2eb03660d
commit 40bc181f31
1 changed files with 1 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
zipl/boot/menu.c
View File

@@ -196,13 +196,9 @@ int menu(void)
value = menu_read();
/* sanity - value too big */
if (value > BOOT_MENU_ENTRIES)
panic(EINTERNAL, "%s", msg_econfig);
boot:
/* sanity - config entry not valid */
if (__stage2_params.config[value] == 0)
if (value > BOOT_MENU_ENTRIES || __stage2_params.config[value] == 0)
panic(EINTERNAL, "%s", msg_econfig);
printf("Booting %s\n",