diff options
| author | Rafał Miłecki <zajec5@gmail.com> | 2014-12-10 11:49:54 +0100 |
|---|---|---|
| committer | Ralf Baechle <ralf@linux-mips.org> | 2015-04-01 17:21:59 +0200 |
| commit | 80aaaa8b93d860f828e2cf883f307894640765f0 (patch) | |
| tree | 1ab2f6d09a17c3864acc59c8834e580db6695d9e /arch/mips/bcm47xx | |
| parent | 23d2bc42aceb829eaf90c694941e4523c22865e8 (diff) | |
| download | lwn-80aaaa8b93d860f828e2cf883f307894640765f0.tar.gz lwn-80aaaa8b93d860f828e2cf883f307894640765f0.zip | |
MIPS: BCM47XX: Use strnchr to avoid reading out of the buffer
Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Cc: Hauke Mehrtens <hauke@hauke-m.de>
Cc: Paul Walmsley <paul@pwsan.com>
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/8662/
Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Diffstat (limited to 'arch/mips/bcm47xx')
| -rw-r--r-- | arch/mips/bcm47xx/nvram.c | 6 |
1 files changed, 4 insertions, 2 deletions
diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c index 5e4ae042deb9..d805d8af415f 100644 --- a/arch/mips/bcm47xx/nvram.c +++ b/arch/mips/bcm47xx/nvram.c @@ -175,7 +175,7 @@ static int nvram_init(void) int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len) { char *var, *value, *end, *eq; - int err; + int data_left, err; if (!name) return -EINVAL; @@ -191,7 +191,9 @@ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len) end = nvram_buf + sizeof(nvram_buf) - 2; end[0] = end[1] = '\0'; for (; *var; var = value + strlen(value) + 1) { - eq = strchr(var, '='); + data_left = end - var; + + eq = strnchr(var, data_left, '='); if (!eq) break; value = eq + 1; |