coja/lbmk
1
0
Fork 0
mirror of https://codeberg.org/libreboot/lbmk.git synced 2026-07-16 12:54:03 +02:00
Code Issues Packages Projects Releases Wiki Activity

util/nvmutil: fix buffer overread in prw()

Browse Source 
edge case scenario, unlikely to actually trigger.

now impossible to trigger.

Signed-off-by: Leah Rowe <leah@libreboot.org>
This commit is contained in:
Leah Rowe
2026-03-10 10:14:25 +00:00
parent 19ee28161e
commit b56cfbcc54
1 changed files with 11 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
util/nvmutil/nvmutil.c
+11 -5
View File
@@ -1319,7 +1319,7 @@ rw_file_exact(int fd, uint8_t *mem, size_t len,
off_t off, int rw_type, const char *path, off_t off, int rw_type, const char *path,
const char *rw_type_str) const char *rw_type_str)
{ {
ssize_t rval = -1; ssize_t rval = 0;
size_t rc = 0; size_t rc = 0;
if (fd < 0) if (fd < 0)
@@ -1331,7 +1331,7 @@ rw_file_exact(int fd, uint8_t *mem, size_t len,
"%s: %s: Requested length (%lu) exceeds SSIZE_MAX (%zd)", "%s: %s: Requested length (%lu) exceeds SSIZE_MAX (%zd)",
path, rw_type_str, len, SSIZE_MAX); path, rw_type_str, len, SSIZE_MAX);
for (rc = 0; rc < len; rc += rval) { while (rc < len) {
if (rw_type == PSCHREIB) if (rw_type == PSCHREIB)
rval = prw(fd, mem + rc, len - rc, rval = prw(fd, mem + rc, len - rc,
off + rc, rw_type, path); off + rc, rw_type, path);
@@ -1346,14 +1346,20 @@ rw_file_exact(int fd, uint8_t *mem, size_t len,
err(EIO, "%s: %s: Unsupported rw_type", err(EIO, "%s: %s: Unsupported rw_type",
path, rw_type_str); path, rw_type_str);
if (rval > -1) { if (rval >= 0) {
if (!rval) /* prevent infinite loop */ if (rval == 0)
err(EIO, "%s: %s: 0-byte return", err(EIO, "%s: %s: 0-byte return",
path, rw_type_str); path, rw_type_str);
if ((size_t)rval > (len - rc))
err(EIO, "%s: %s: Buffer overread trap",
path, rw_type_str);
rc += (size_t)rval;
continue; continue;
} }
if (errno != EINTR || rval < -1) if (errno != EINTR)
err(EIO, "%s: %s", path, rw_type_str); err(EIO, "%s: %s", path, rw_type_str);
errno = 0; errno = 0;