diff mbox series

[3/3] ebg: fix integer underflow

Message ID 20230816092424.203252-4-michael.adler@siemens.com
State Accepted
Delegated to: Stefano Babic
Headers show
Series Regarding efibootguard CVE-2023-39950 | expand

Commit Message

Michael Adler Aug. 16, 2023, 9:24 a.m. UTC 
bgenv_get returns a negative value (-ENOENT) if the variable does not
exist, which results in an integer underflow if the variable `size`
is unsigned. Currently, this results in an attempt to malloc approx. 16
exabytes, which luckily fails on most systems.
The solution is to check for a valid (i.e. positive) size before trying
to malloc it.

Signed-off-by: Michael Adler <michael.adler@siemens.com>
Signed-off-by: Christian Storm <christian.storm@siemens.com>
---
 bootloader/ebg.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
diff mbox series

Patch

diff --git a/bootloader/ebg.c b/bootloader/ebg.c
index 76a1e28..d10e1c4 100644
--- a/bootloader/ebg.c
+++ b/bootloader/ebg.c
@@ -113,8 +113,8 @@  static char *_env_get(const char *name)
 	 * value's size in bytes, the second call, with an accordingly
 	 * sized buffer, yields the actual value.
 	 */
-	size_t size = libebg.env_get(&ebgenv, (char *)name, NULL);
-	if (size == 0) {
+	int size = libebg.env_get(&ebgenv, (char *)name, NULL);
+	if (size <= 0) {
 		WARN("Cannot find key %s", name);
 		return NULL;
 	}