diff mbox series

[1/3] ebg: ensure env_get returns valid strings

Message ID 20230816092424.203252-2-michael.adler@siemens.com
State Accepted
Delegated to: Stefano Babic
Headers show
Series Regarding efibootguard CVE-2023-39950 | expand

Commit Message

Michael Adler Aug. 16, 2023, 9:24 a.m. UTC 
In the case of efibootguard, env_get might return a value which is not
null-terminated because this is allowed for user-defined variables.
However, SWUpdate assumes the returned value is a string, i.e. is
null-terminated. For example, the Lua function get_bootenv allows to
retrieve user-defined values.
This commit adds a check to ensure the returned value is indeed
null-terminated.

Signed-off-by: Michael Adler <michael.adler@siemens.com>
Signed-off-by: Christian Storm <christian.storm@siemens.com>
---
 bootloader/ebg.c | 6 ++++++
 1 file changed, 6 insertions(+)
diff mbox series

Patch

diff --git a/bootloader/ebg.c b/bootloader/ebg.c
index 4064f07..ce7e03a 100644
--- a/bootloader/ebg.c
+++ b/bootloader/ebg.c
@@ -131,6 +131,12 @@  static char *_env_get(const char *name)
 		free(value);
 		return NULL;
 	}
+	/* ensure value is null-terminated (string) */
+	if (value[size - 1] != '\0') {
+		ERROR("Cannot handle value of key %s", name);
+		free(value);
+		return NULL;
+	}
 	return value;
 }