Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit c7b73835 authored by Dan Carpenter's avatar Dan Carpenter Committed by H. Peter Anvin
Browse files

x86, efi: Fix pointer math issue in handle_ramdisks() 



"filename" is a efi_char16_t string so this check for reaching the end
of the array doesn't work.  We need to cast the pointer to (u8 *) before
doing the math.

This patch changes the "filename" to "filename_16" to avoid confusion in
the future.

Signed-off-by: default avatarDan Carpenter <dan.carpenter@oracle.com>
Link: http://lkml.kernel.org/r/20120305180614.GA26880@elgon.mountain


Acked-by: default avatarMatt Fleming <matt.fleming@intel.com>
Signed-off-by: default avatarH. Peter Anvin <hpa@linux.intel.com>
parent 73d63d03

arch/x86/boot/compressed/eboot.c

+4 −4
Original line number Diff line number Diff line
@@ -539,7 +539,7 @@ static efi_status_t handle_ramdisks(efi_loaded_image_t *image, 
		struct initrd *initrd;

		efi_file_handle_t *h;

		efi_file_info_t *info;

		efi_char16_t filename[256];

		efi_char16_t filename_16[256];

		unsigned long info_sz;

		efi_guid_t info_guid = EFI_FILE_INFO_ID;

		efi_char16_t *p;
@@ -552,14 +552,14 @@ static efi_status_t handle_ramdisks(efi_loaded_image_t *image, 
		str += 7;



		initrd = &initrds[i];

		p = filename;

		p = filename_16;



		/* Skip any leading slashes */

		while (*str == '/' || *str == '\\')

			str++;



		while (*str && *str != ' ' && *str != '\n') {

			if (p >= filename + sizeof(filename))

			if ((u8 *)p >= (u8 *)filename_16 + sizeof(filename_16))

				break;



			*p++ = *str++;
@@ -583,7 +583,7 @@ static efi_status_t handle_ramdisks(efi_loaded_image_t *image, 
				goto free_initrds;

		}



		status = efi_call_phys5(fh->open, fh, &h, filename,

		status = efi_call_phys5(fh->open, fh, &h, filename_16,

					EFI_FILE_MODE_READ, (u64)0);

		if (status != EFI_SUCCESS)

			goto close_handles;