From 4eea67cd6f100e7db7b71a03495e97a8db96490a Mon Sep 17 00:00:00 2001 From: Marc Hartmayer Date: Tue, 31 Mar 2020 11:20:27 +0200 Subject: [PATCH] zipl/stage3: fix buffer overflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The inserted blank must also be taken into account for the calculation of `cmdline_len`. In general it's only possible to insert a blank if the command line length is not already the maximum. Reviewed-by: Philipp Rudo Reviewed-by: Stefan Haberland Signed-off-by: Marc Hartmayer Signed-off-by: Jan Höppner --- zipl/boot/stage3.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/zipl/boot/stage3.c b/zipl/boot/stage3.c index 954dcffd..115a2085 100644 --- a/zipl/boot/stage3.c +++ b/zipl/boot/stage3.c @@ -201,13 +201,13 @@ void start(void) */ if (*cextra == 0x3d) { memcpy(cmdline, cextra, cextra_len); - } else { - /* check if length is within max value */ - cextra_len = (cmdline_len + 1 + cextra_len <= COMMAND_LINE_SIZE) ? - cextra_len : (COMMAND_LINE_SIZE - cmdline_len - 1); + } else if (cmdline_len + 1 <= COMMAND_LINE_SIZE - 1) { /* add blank */ cmdline[cmdline_len] = 0x20; cmdline_len++; + /* check if length is within max value */ + cextra_len = (cmdline_len + cextra_len <= COMMAND_LINE_SIZE - 1) ? + cextra_len : (COMMAND_LINE_SIZE - 1 - cmdline_len); /* append string */ memcpy(cmdline + cmdline_len, cextra, cextra_len); /* terminate 0 */