kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zipl/stage3: fix buffer overflow

Browse Source 
The inserted blank must also be taken into account for the calculation
of `cmdline_len`. In general it's only possible to insert a blank if
the command line length is not already the maximum.

Reviewed-by: Philipp Rudo <prudo@linux.ibm.com>
Reviewed-by: Stefan Haberland <sth@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2020-03-31 11:20:27 +02:00
committed by Jan Höppner
parent 9a68a25ab6
commit 4eea67cd6f
1 changed files with 4 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
zipl/boot/stage3.c
View File

@@ -201,13 +201,13 @@ void start(void)
*/
if (*cextra == 0x3d) {
memcpy(cmdline, cextra, cextra_len);
} else {
/* check if length is within max value */
cextra_len = (cmdline_len + 1 + cextra_len <= COMMAND_LINE_SIZE) ?
cextra_len : (COMMAND_LINE_SIZE - cmdline_len - 1);
} else if (cmdline_len + 1 <= COMMAND_LINE_SIZE - 1) {
/* add blank */
cmdline[cmdline_len] = 0x20;
cmdline_len++;
/* check if length is within max value */
cextra_len = (cmdline_len + cextra_len <= COMMAND_LINE_SIZE - 1) ?
cextra_len : (COMMAND_LINE_SIZE - 1 - cmdline_len);
/* append string */
memcpy(cmdline + cmdline_len, cextra, cextra_len);
/* terminate 0 */