coja/lbmk
1
0
Fork 0
mirror of https://codeberg.org/libreboot/lbmk.git synced 2026-07-21 19:26:22 +02:00
Code Issues Packages Projects Releases Wiki Activity

util/nvmutil: abort if I/O len exceeds SSIZE_MAX

Browse Source 
in rw_file_exact

otherwise, if length exceeds SSIZE_MAX, we could
hit an overflow

the buffers and lengths we deal with are relatively
small anyway, so this fix is preventative

Signed-off-by: Leah Rowe <leah@libreboot.org>
This commit is contained in:
Leah Rowe
2026-03-10 05:33:12 +00:00
parent 93a4ec3497
commit 9747ca4151
1 changed files with 8 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
util/nvmutil/nvmutil.c
+8
View File
@@ -267,6 +267,10 @@ static const char *mac_str;
static const char *fname; static const char *fname;
static const char *argv0; static const char *argv0;
#ifndef SSIZE_MAX
#define SSIZE_MAX ((ssize_t)((size_t)-1 >> 1))
#endif
/* /*
* Use these for .invert in command[]: * Use these for .invert in command[]:
* If set to 1: read/write inverter (p0->p1, p1->p0) * If set to 1: read/write inverter (p0->p1, p1->p0)
@@ -1327,6 +1331,10 @@ rw_file_exact(int fd, uint8_t *mem, size_t len,
err(EIO, "%s: %s: Bad fd %d", path, rw_type_str, fd); err(EIO, "%s: %s: Bad fd %d", path, rw_type_str, fd);
if (!len) if (!len)
err(EIO, "%s: %s: Zero length", path, rw_type_str); err(EIO, "%s: %s: Zero length", path, rw_type_str);
if (len > (size_t)SSIZE_MAX)
err(EIO,
"%s: %s: Requested length (%zu) exceeds SSIZE_MAX (%zd)",
path, rw_type_str, len, SSIZE_MAX);
for (rc = 0; rc != (ssize_t)len; rc += rval) { for (rc = 0; rc != (ssize_t)len; rc += rval) {
if (rw_type == PSCHREIB) if (rw_type == PSCHREIB)