kata-containers/s390-tools
1
0
Fork 0
mirror of https://github.com/ibm-s390-linux/s390-tools.git synced 2026-08-05 02:14:52 +00:00
Code Issues Packages Projects Releases Wiki Activity

zipl/boot: Fix two off-by-one bugs

Browse Source 
Fix two off-by-one errors:

+ One caused an out-of-bounds read when the loadparm value was 63
+ The other made a boot entry unselectable.

Currently, these bugs have no practical impact because:

1. The memory area beyond __stage2_params.config[63] is empty.
2. BOOT_MENU_ENTRIES is set to 63, which exceeds the number of boot menu
   entries that can be written to disk.

Reviewed-by: Mikhail Zaslonko <zaslonko@linux.ibm.com>
Reviewed-by: Eduard Shishkin <edward6@linux.ibm.com>
Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
Signed-off-by: Steffen Eiden <seiden@linux.ibm.com>
This commit is contained in:
Marc Hartmayer
2025-12-04 09:58:55 +00:00
committed by Steffen Eiden
parent ce82010827
commit 8d58a9abb0
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
zipl/boot/menu.c
View File

@@ -61,7 +61,7 @@ static int menu_read(void)
temp_area[i] = ebcdic_tolower(temp_area[i]);
value = ebcdic_strtoul(temp_area, &endptr, 10);
if ((endptr != temp_area) && (value < BOOT_MENU_ENTRIES - 1) &&
if ((endptr != temp_area) && (value < BOOT_MENU_ENTRIES) &&
(__stage2_params.config[value] != 0)) {
/* valid config found - finish */
break;
@@ -198,7 +198,7 @@ int menu(void)
boot:
/* sanity - config entry not valid */
if (value > BOOT_MENU_ENTRIES || __stage2_params.config[value] == 0)
if (value >= BOOT_MENU_ENTRIES || __stage2_params.config[value] == 0)
panic(EINTERNAL, "%s", msg_econfig);
printf("Booting %s\n",