diff options
| author | Michael Brown | 2008-08-14 04:03:53 +0200 |
|---|---|---|
| committer | Michael Brown | 2008-08-14 04:03:53 +0200 |
| commit | 8f8f5acf0930710f8974af8a644305c3b3afabdf (patch) | |
| tree | 28fc1f570dcd187ffc23c7954abaa7e8169a5a13 | |
| parent | [dhcp] Do not restrict minimum retry time for ProxyDHCPREQUEST (diff) | |
| download | ipxe-8f8f5acf0930710f8974af8a644305c3b3afabdf.tar.gz ipxe-8f8f5acf0930710f8974af8a644305c3b3afabdf.tar.xz ipxe-8f8f5acf0930710f8974af8a644305c3b3afabdf.zip | |
[settings] Avoid overwriting the start of .text in fetch_string_setting()
fetch_string_setting() was subtracting one from the length of the
to-be-NUL-terminated buffer in order to obtain the length of the
unterminated buffer to be passed to fetch_setting(). This works
extremely well unless the length of the to-be-NUL-terminated buffer is
zero, at which point we end up giving fetch_setting() a buffer of
length -1UL, thereby inviting it to overwrite as much memory as it
wants...
| -rw-r--r-- | src/core/settings.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/core/settings.c b/src/core/settings.c index 75253186..e660ae7c 100644 --- a/src/core/settings.c +++ b/src/core/settings.c @@ -381,7 +381,8 @@ int fetch_setting_len ( struct settings *settings, struct setting *setting ) { int fetch_string_setting ( struct settings *settings, struct setting *setting, char *data, size_t len ) { memset ( data, 0, len ); - return fetch_setting ( settings, setting, data, ( len - 1 ) ); + return fetch_setting ( settings, setting, data, + ( ( len > 0 ) ? ( len - 1 ) : 0 ) ); } /** |