mirror of
https://codeberg.org/libreboot/lbmk.git
synced 2026-07-19 09:32:27 +02:00
util/nvmutil: rw file: guard rc before addition
otherwise, it could still overflow Signed-off-by: Leah Rowe <leah@libreboot.org>
This commit is contained in:
@@ -1883,6 +1883,10 @@ rw_file_exact(int fd, u8 *mem, size_t nrw,
|
|||||||
|
|
||||||
while (1) {
|
while (1) {
|
||||||
|
|
||||||
|
/* Prevent theoretical overflow */
|
||||||
|
if ((size_t)rv > (nrw - rc))
|
||||||
|
goto err_rw_file_exact;
|
||||||
|
|
||||||
rc += rv;
|
rc += rv;
|
||||||
if ((size_t)rc >= nrw)
|
if ((size_t)rc >= nrw)
|
||||||
break;
|
break;
|
||||||
@@ -1897,10 +1901,6 @@ rw_file_exact(int fd, u8 *mem, size_t nrw,
|
|||||||
if (rv < 0)
|
if (rv < 0)
|
||||||
return -1;
|
return -1;
|
||||||
|
|
||||||
/* Prevent theoretical overflow */
|
|
||||||
if ((size_t)rv > (nrw - rc))
|
|
||||||
goto err_rw_file_exact;
|
|
||||||
|
|
||||||
if (rv == 0) {
|
if (rv == 0) {
|
||||||
if (retries_on_zero++ < max_retries)
|
if (retries_on_zero++ < max_retries)
|
||||||
continue;
|
continue;
|
||||||
|
|||||||
Reference in New Issue
Block a user