summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorRafał Miłecki <zajec5@gmail.com>2014-12-10 11:49:54 +0100
committerRalf Baechle <ralf@linux-mips.org>2015-04-01 17:21:59 +0200
commit80aaaa8b93d860f828e2cf883f307894640765f0 (patch)
tree1ab2f6d09a17c3864acc59c8834e580db6695d9e
parent23d2bc42aceb829eaf90c694941e4523c22865e8 (diff)
downloadlinux-80aaaa8b93d860f828e2cf883f307894640765f0.tar.bz2
MIPS: BCM47XX: Use strnchr to avoid reading out of the buffer
Signed-off-by: Rafał Miłecki <zajec5@gmail.com> Cc: Hauke Mehrtens <hauke@hauke-m.de> Cc: Paul Walmsley <paul@pwsan.com> Cc: linux-mips@linux-mips.org Patchwork: https://patchwork.linux-mips.org/patch/8662/ Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
-rw-r--r--arch/mips/bcm47xx/nvram.c6
1 files changed, 4 insertions, 2 deletions
diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
index 5e4ae042deb9..d805d8af415f 100644
--- a/arch/mips/bcm47xx/nvram.c
+++ b/arch/mips/bcm47xx/nvram.c
@@ -175,7 +175,7 @@ static int nvram_init(void)
int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
{
char *var, *value, *end, *eq;
- int err;
+ int data_left, err;
if (!name)
return -EINVAL;
@@ -191,7 +191,9 @@ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
end = nvram_buf + sizeof(nvram_buf) - 2;
end[0] = end[1] = '\0';
for (; *var; var = value + strlen(value) + 1) {
- eq = strchr(var, '=');
+ data_left = end - var;
+
+ eq = strnchr(var, data_left, '=');
if (!eq)
break;
value = eq + 1;