diff options
author | Linus Torvalds <torvalds@linux-foundation.org> | 2016-04-28 19:54:50 -0700 |
---|---|---|
committer | Linus Torvalds <torvalds@linux-foundation.org> | 2016-04-28 19:54:50 -0700 |
commit | 8f3603a210970d665e7cecf6623331ce6b24f713 (patch) | |
tree | 3dc33db5d8ea1c8a741a91d0e05c38629753352e /drivers/firmware | |
parent | ba14e961b4fc0b0efcb1b2af7aab605bfce55fb8 (diff) | |
parent | ede85e90be26e5de2a72f76feec01cfc5281d4bd (diff) | |
download | linux-stable-8f3603a210970d665e7cecf6623331ce6b24f713.tar.gz linux-stable-8f3603a210970d665e7cecf6623331ce6b24f713.tar.bz2 linux-stable-8f3603a210970d665e7cecf6623331ce6b24f713.zip |
Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull EFI fix from Ingo Molnar:
"This fixes a bug in the efivars code"
* 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
efi: Fix out-of-bounds read in variable_matches()
Diffstat (limited to 'drivers/firmware')
-rw-r--r-- | drivers/firmware/efi/vars.c | 37 |
1 files changed, 26 insertions, 11 deletions
diff --git a/drivers/firmware/efi/vars.c b/drivers/firmware/efi/vars.c index 0ac594c0a234..34b741940494 100644 --- a/drivers/firmware/efi/vars.c +++ b/drivers/firmware/efi/vars.c @@ -202,29 +202,44 @@ static const struct variable_validate variable_validate[] = { { NULL_GUID, "", NULL }, }; +/* + * Check if @var_name matches the pattern given in @match_name. + * + * @var_name: an array of @len non-NUL characters. + * @match_name: a NUL-terminated pattern string, optionally ending in "*". A + * final "*" character matches any trailing characters @var_name, + * including the case when there are none left in @var_name. + * @match: on output, the number of non-wildcard characters in @match_name + * that @var_name matches, regardless of the return value. + * @return: whether @var_name fully matches @match_name. + */ static bool variable_matches(const char *var_name, size_t len, const char *match_name, int *match) { for (*match = 0; ; (*match)++) { char c = match_name[*match]; - char u = var_name[*match]; - /* Wildcard in the matching name means we've matched */ - if (c == '*') + switch (c) { + case '*': + /* Wildcard in @match_name means we've matched. */ return true; - /* Case sensitive match */ - if (!c && *match == len) - return true; + case '\0': + /* @match_name has ended. Has @var_name too? */ + return (*match == len); - if (c != u) + default: + /* + * We've reached a non-wildcard char in @match_name. + * Continue only if there's an identical character in + * @var_name. + */ + if (*match < len && c == var_name[*match]) + continue; return false; - - if (!c) - return true; + } } - return true; } bool |