efivars: check path_len before using it as loop boundary

2018-10-12 14:51:35 +02:00
parent c52368509f
commit e7e36b9030
1 changed files with 6 additions and 2 deletions
@@ -412,9 +412,13 @@ int efi_get_boot_option(

        if (header->path_len > 0) {
                uint8_t *dbuf;
-                size_t dnext;
+                size_t dnext, doff;
+
+                doff = offsetof(struct boot_option, title) + title_size;
+                dbuf = buf + doff;
+                if (header->path_len > l - doff)
+                        return -EINVAL;

-                dbuf = buf + offsetof(struct boot_option, title) + title_size;
                dnext = 0;
                while (dnext < header->path_len) {
                        struct device_path *dpath;