diff mbox series

[05/10] env: Check for terminating null-byte in env_match()

Message ID 20211012110501.6118-6-kabel@kernel.org
State Superseded
Delegated to: Simon Glass
Headers show
Series env_get_char() removal and env_get_f() refactor | expand

Commit Message

Marek Behún Oct. 12, 2021, 11:04 a.m. UTC 
From: Marek Behún <marek.behun@nic.cz>

There is a possible overflow in env_match(): if environment contains
a terminating null-byte before '=' character (i.e. environment is
broken), the env_match() function can access data after the terminating
null-byte from parameter pointer.

Example: if env_get_char() returns characters from string array
"abc\0def\0" and env_match("abc", 0) is called, the function will access
at least one byte after the end of the "abc" literal.

Signed-off-by: Marek Behún <marek.behun@nic.cz>
---
 cmd/nvedit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

Comments

Marek Behún Oct. 13, 2021, 3:35 p.m. UTC | #1 
On Tue, 12 Oct 2021 13:04:56 +0200
Marek Behún <kabel@kernel.org> wrote:

> -	while (*s1 == env_get_char(i2++))
> +	while (*s1 != '\0' && *s1 == env_get_char(i2++))

This check has to be done in the other order:
  while (*s1 == env_get_char(i2++) && *s1 != '\0')

so that i2 gets incremented even if *s1 == '\0'.

Will be fixed in v2.
diff mbox series

Patch

diff --git a/cmd/nvedit.c b/cmd/nvedit.c
index e2e8a38b5d..a516491832 100644
--- a/cmd/nvedit.c
+++ b/cmd/nvedit.c
@@ -711,7 +711,7 @@  static int env_match(uchar *s1, int i2)
 	if (s1 == NULL || *s1 == '\0')
 		return -1;
 
-	while (*s1 == env_get_char(i2++))
+	while (*s1 != '\0' && *s1 == env_get_char(i2++))
 		if (*s1++ == '=')
 			return i2;