coja/lbmk
1
0
Fork 0
mirror of https://codeberg.org/libreboot/lbmk.git synced 2026-07-16 13:16:47 +02:00
Code Issues Packages Projects Releases Wiki Activity

util/nvmutil: stricter i/o length check

Browse Source 
Signed-off-by: Leah Rowe <leah@libreboot.org>
This commit is contained in:
Leah Rowe
2026-03-13 15:06:29 +00:00
parent d8be79432c
commit 386f715a29
1 changed files with 10 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
util/nvmutil/nvmutil.c
+10 -1
View File
@@ -380,6 +380,8 @@ static void usage(uint8_t usage_exit);
#define NVM_WORDS (NVM_SIZE >> 1) #define NVM_WORDS (NVM_SIZE >> 1)
#define NVM_CHECKSUM_WORD (NVM_WORDS - 1) #define NVM_CHECKSUM_WORD (NVM_WORDS - 1)
#define NUM_RANDOM_BYTES 12
/* /*
* Portable macro based on BSD nitems. * Portable macro based on BSD nitems.
* Used to count the number of commands (see below). * Used to count the number of commands (see below).
@@ -566,6 +568,8 @@ typedef char assert_read[(IO_READ==0)?1:-1];
typedef char assert_write[(IO_WRITE==1)?1:-1]; typedef char assert_write[(IO_WRITE==1)?1:-1];
typedef char assert_pread[(IO_PREAD==2)?1:-1]; typedef char assert_pread[(IO_PREAD==2)?1:-1];
typedef char assert_pwrite[(IO_PWRITE==3)?1:-1]; typedef char assert_pwrite[(IO_PWRITE==3)?1:-1];
typedef char assert_rand_byte[(NUM_RANDOM_BYTES>0)?1:-1];
typedef char assert_rand_len[(NUM_RANDOM_BYTES<NVM_SIZE)?1:-1];
/* commands */ /* commands */
typedef char assert_cmd_dump[(CMD_DUMP==0)?1:-1]; typedef char assert_cmd_dump[(CMD_DUMP==0)?1:-1];
typedef char assert_cmd_setmac[(CMD_SETMAC==1)?1:-1]; typedef char assert_cmd_setmac[(CMD_SETMAC==1)?1:-1];
@@ -1126,7 +1130,7 @@ static uint16_t
rhex(void) rhex(void)
{ {
static size_t n = 0; static size_t n = 0;
static uint8_t rnum[12]; static uint8_t rnum[NUM_RANDOM_BYTES];
if (use_prng) if (use_prng)
return fallback_rand(); return fallback_rand();
@@ -1593,6 +1597,11 @@ rw_file_once(int fd, uint8_t *mem, size_t nrw,
size_t retries_on_zero = 0; size_t retries_on_zero = 0;
size_t max_retries = 10; size_t max_retries = 10;
if (nrw != GBE_PART_SIZE &&
nrw != NVM_SIZE &&
nrw != NUM_RANDOM_BYTES)
goto err_rw_file_once;
if (fd < 0 || !nrw || nrw > (size_t)SSIZE_MAX if (fd < 0 || !nrw || nrw > (size_t)SSIZE_MAX
|| (unsigned int)rw_type > IO_PWRITE) || (unsigned int)rw_type > IO_PWRITE)
goto err_rw_file_once; goto err_rw_file_once;