summaryrefslogtreecommitdiff
path: root/lib
diff options
context:
space:
mode:
authorLukasz Majewski <l.majewski@majess.pl>2015-09-14 00:57:03 +0200
committerTom Rini <trini@konsulko.com>2015-09-15 15:05:08 -0400
commit817e48d8a2998b19dc36a77f8363b5f74bc3fa9e (patch)
treed061ffbb45f7f2f133ac29b2e4ac46cc9e2a418f /lib
parentca7def6003d376eb50547c468167e10cb5c2b835 (diff)
downloadu-boot-imx-817e48d8a2998b19dc36a77f8363b5f74bc3fa9e.zip
u-boot-imx-817e48d8a2998b19dc36a77f8363b5f74bc3fa9e.tar.gz
u-boot-imx-817e48d8a2998b19dc36a77f8363b5f74bc3fa9e.tar.bz2
env: import: hashtable: Prevent buffer overrun when importing environment from file
Lets consider following scenario: - One uses echo -n "key=value" to define environment variable in a file (single variable) - The file content is "key=value" without any terminating byte (e.g. 0x0a or 0x0d). - The file is loaded to u-boot non zero'ed RAM buffer (with load command). - Then "env import -t -r $loadaddr $filesize" is executed. - Due to lack of proper termination byte we have classical example of buffer overrun. This patch prevents from this by allocating one extra byte than size and explicitly null terminate it. There should be no change for normal env import operation after applying this patch. Signed-off-by: Lukasz Majewski <l.majewski@majess.pl>
Diffstat (limited to 'lib')
-rw-r--r--lib/hashtable.c5
1 files changed, 3 insertions, 2 deletions
diff --git a/lib/hashtable.c b/lib/hashtable.c
index 18ed590..7df424a 100644
--- a/lib/hashtable.c
+++ b/lib/hashtable.c
@@ -789,12 +789,13 @@ int himport_r(struct hsearch_data *htab,
}
/* we allocate new space to make sure we can write to the array */
- if ((data = malloc(size)) == NULL) {
- debug("himport_r: can't malloc %zu bytes\n", size);
+ if ((data = malloc(size + 1)) == NULL) {
+ debug("himport_r: can't malloc %zu bytes\n", size + 1);
__set_errno(ENOMEM);
return 0;
}
memcpy(data, env, size);
+ data[size] = '\0';
dp = data;
/* make a local copy of the list of variables */