erebion/coreboot
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Fix a corner case access to uninitialized memory (NULL pointer

Browse source 
dereference or worse) in case the archive length is exactly
sizeof(struct lar_header). Such an archive is invalid because the
filename directly after the LAR header is always dereferenced and has to
be at least 1 byte in the "empty filename" case (only terminating \0).
Improve LAR code documentation and reorder variables in one assignment
to make the code more obvious and readable. This will help people
understand what the code does when they look at it half a year from now.

Signed-off-by: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Acked-by: Uwe Hermann <uwe@hermann-uwe.de>



git-svn-id: svn://coreboot.org/repository/LinuxBIOSv3@506 f3766cd6-281f-0410-b1cd-43a5c92072e9
This commit is contained in:
Carl-Daniel Hailfinger 2007-10-16 18:59:36 +00:00
commit b9c8454adf
4 changed files with 58 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

3
include/lar.h
View file

@ -52,10 +52,9 @@
#include <types.h>
/* see note in lib/lar.c as to why this is ARCHIVE and not LARCHIVE */
#define MAGIC "LARCHIVE"
#define MAX_PATHLEN 1024
/* NOTE -- This and the user-mode lar.h are NOT IN SYNC. Be careful. */
/* NOTE -- This and the user-mode lar.h may NOT be in sync. Be careful. */
struct lar_header {
char magic[8];
u32 len;