Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 8f3603a2 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull EFI fix from Ingo Molnar:
 "This fixes a bug in the efivars code"

* 'efi-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  efi: Fix out-of-bounds read in variable_matches()
parents ba14e961 ede85e90
Loading
Loading
Loading
Loading
+26 −11
Original line number Diff line number Diff line
@@ -202,29 +202,44 @@ static const struct variable_validate variable_validate[] = {
	{ NULL_GUID, "", NULL },
};

/*
 * Check if @var_name matches the pattern given in @match_name.
 *
 * @var_name: an array of @len non-NUL characters.
 * @match_name: a NUL-terminated pattern string, optionally ending in "*". A
 *              final "*" character matches any trailing characters @var_name,
 *              including the case when there are none left in @var_name.
 * @match: on output, the number of non-wildcard characters in @match_name
 *         that @var_name matches, regardless of the return value.
 * @return: whether @var_name fully matches @match_name.
 */
static bool
variable_matches(const char *var_name, size_t len, const char *match_name,
		 int *match)
{
	for (*match = 0; ; (*match)++) {
		char c = match_name[*match];
		char u = var_name[*match];

		/* Wildcard in the matching name means we've matched */
		if (c == '*')
		switch (c) {
		case '*':
			/* Wildcard in @match_name means we've matched. */
			return true;

		/* Case sensitive match */
		if (!c && *match == len)
			return true;
		case '\0':
			/* @match_name has ended. Has @var_name too? */
			return (*match == len);

		if (c != u)
		default:
			/*
			 * We've reached a non-wildcard char in @match_name.
			 * Continue only if there's an identical character in
			 * @var_name.
			 */
			if (*match < len && c == var_name[*match])
				continue;
			return false;

		if (!c)
			return true;
		}
	return true;
	}
}

bool