summaryrefslogtreecommitdiffstats
path: root/lib
diff options
context:
space:
mode:
authorIvan Gorinov <ivan.gorinov@intel.com>2018-05-11 13:18:25 -0700
committerAlexander Graf <agraf@suse.de>2018-06-03 15:27:20 +0200
commitd73c8bc052f9b5f472b59ccd3c88e3ecc6359075 (patch)
tree29eed9b5140dbaa75a9547038aa95713495fac6b /lib
parent71cee4ce68e19c0bf67e5b587ba2e1b940d18d09 (diff)
downloadu-boot-d73c8bc052f9b5f472b59ccd3c88e3ecc6359075.tar.gz
u-boot-d73c8bc052f9b5f472b59ccd3c88e3ecc6359075.tar.xz
u-boot-d73c8bc052f9b5f472b59ccd3c88e3ecc6359075.zip
efi_loader: fix off-by-one bug in efi_get_variable
efi_get_variable() always stores an extra zero byte after the output data. When the returned data size matches the output buffer size, the extra zero byte is stored past the end of the output buffer. Signed-off-by: Ivan Gorinov <ivan.gorinov@intel.com> Reviewed-by: Heinrich Schuchardt <xypron.glpk@gmx.de> Signed-off-by: Alexander Graf <agraf@suse.de>
Diffstat (limited to 'lib')
-rw-r--r--lib/efi_loader/efi_variable.c40
1 files changed, 16 insertions, 24 deletions
diff --git a/lib/efi_loader/efi_variable.c b/lib/efi_loader/efi_variable.c
index 64cf981cdc..90b637215e 100644
--- a/lib/efi_loader/efi_variable.c
+++ b/lib/efi_loader/efi_variable.c
@@ -49,7 +49,7 @@
(strlen("efi_xxxxxxxx-xxxx-xxxx-xxxxxxxxxxxxxxxx_") + \
(MAX_VAR_NAME * MAX_UTF8_PER_UTF16))
-static int hex(unsigned char ch)
+static int hex(int ch)
{
if (ch >= 'a' && ch <= 'f')
return ch-'a'+10;
@@ -60,44 +60,32 @@ static int hex(unsigned char ch)
return -1;
}
-static const char *hex2mem(u8 *mem, const char *hexstr, int count)
+static int hex2mem(u8 *mem, const char *hexstr, int size)
{
- memset(mem, 0, count/2);
+ int nibble;
+ int i;
- do {
- int nibble;
-
- *mem = 0;
-
- if (!count || !*hexstr)
+ for (i = 0; i < size; i++) {
+ if (*hexstr == '\0')
break;
nibble = hex(*hexstr);
if (nibble < 0)
- break;
+ return -1;
*mem = nibble;
- count--;
hexstr++;
- if (!count || !*hexstr)
- break;
-
nibble = hex(*hexstr);
if (nibble < 0)
- break;
+ return -1;
*mem = (*mem << 4) | nibble;
- count--;
hexstr++;
mem++;
+ }
- } while (1);
-
- if (*hexstr)
- return hexstr;
-
- return NULL;
+ return i;
}
static char *mem2hex(char *hexstr, const u8 *mem, int count)
@@ -209,8 +197,12 @@ efi_status_t EFIAPI efi_get_variable(u16 *variable_name, efi_guid_t *vendor,
if ((s = prefix(val, "(blob)"))) {
unsigned len = strlen(s);
+ /* number of hexadecimal digits must be even */
+ if (len & 1)
+ return EFI_EXIT(EFI_DEVICE_ERROR);
+
/* two characters per byte: */
- len = DIV_ROUND_UP(len, 2);
+ len /= 2;
*data_size = len;
if (in_size < len)
@@ -219,7 +211,7 @@ efi_status_t EFIAPI efi_get_variable(u16 *variable_name, efi_guid_t *vendor,
if (!data)
return EFI_EXIT(EFI_INVALID_PARAMETER);
- if (hex2mem(data, s, len * 2))
+ if (hex2mem(data, s, len) != len)
return EFI_EXIT(EFI_DEVICE_ERROR);
debug("%s: got value: \"%s\"\n", __func__, s);