util/nvmutil: fix rc overflow bug in rw_file_exact

check that it's below len, not above it. that way, it
will now exit if it goes above (which it shouldn't,
but it theoretically could if the code was changed
and there was a regression or subtle edge case)

Signed-off-by: Leah Rowe <leah@libreboot.org>
This commit is contained in:
Leah Rowe
2026-03-10 10:00:20 +00:00
parent 6d27853f56
commit 19ee28161e
+1 -1
View File
@@ -1331,7 +1331,7 @@ rw_file_exact(int fd, uint8_t *mem, size_t len,
"%s: %s: Requested length (%lu) exceeds SSIZE_MAX (%zd)",
path, rw_type_str, len, SSIZE_MAX);
for (rc = 0; rc != len; rc += rval) {
for (rc = 0; rc < len; rc += rval) {
if (rw_type == PSCHREIB)
rval = prw(fd, mem + rc, len - rc,
off + rc, rw_type, path);