From 9f740ddc0ddccb3fcdb5fedca1fb6abe84eee850 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= Date: Tue, 7 Apr 2015 12:54:23 +0000 Subject: brcm47xx: backport MIPS BCM47XX patches queued for 4.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Rafał Miłecki SVN-Revision: 45288 --- ...X-Use-strnchr-to-avoid-reading-out-of-the.patch | 45 ++++++++++++++++++++++ 1 file changed, 45 insertions(+) create mode 100644 target/linux/brcm47xx/patches-3.18/031-04-MIPS-BCM47XX-Use-strnchr-to-avoid-reading-out-of-the.patch (limited to 'target/linux/brcm47xx/patches-3.18/031-04-MIPS-BCM47XX-Use-strnchr-to-avoid-reading-out-of-the.patch') diff --git a/target/linux/brcm47xx/patches-3.18/031-04-MIPS-BCM47XX-Use-strnchr-to-avoid-reading-out-of-the.patch b/target/linux/brcm47xx/patches-3.18/031-04-MIPS-BCM47XX-Use-strnchr-to-avoid-reading-out-of-the.patch new file mode 100644 index 0000000000..7b16835ae9 --- /dev/null +++ b/target/linux/brcm47xx/patches-3.18/031-04-MIPS-BCM47XX-Use-strnchr-to-avoid-reading-out-of-the.patch @@ -0,0 +1,45 @@ +From 80aaaa8b93d860f828e2cf883f307894640765f0 Mon Sep 17 00:00:00 2001 +From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= +Date: Wed, 10 Dec 2014 11:49:54 +0100 +Subject: [PATCH] MIPS: BCM47XX: Use strnchr to avoid reading out of the buffer +MIME-Version: 1.0 +Content-Type: text/plain; charset=UTF-8 +Content-Transfer-Encoding: 8bit + +Signed-off-by: Rafał Miłecki +Cc: Hauke Mehrtens +Cc: Paul Walmsley +Cc: linux-mips@linux-mips.org +Patchwork: https://patchwork.linux-mips.org/patch/8662/ +Signed-off-by: Ralf Baechle +--- + arch/mips/bcm47xx/nvram.c | 6 ++++-- + 1 file changed, 4 insertions(+), 2 deletions(-) + +diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c +index 5e4ae04..d805d8a 100644 +--- a/arch/mips/bcm47xx/nvram.c ++++ b/arch/mips/bcm47xx/nvram.c +@@ -175,7 +175,7 @@ static int nvram_init(void) + int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len) + { + char *var, *value, *end, *eq; +- int err; ++ int data_left, err; + + if (!name) + return -EINVAL; +@@ -191,7 +191,9 @@ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len) + end = nvram_buf + sizeof(nvram_buf) - 2; + end[0] = end[1] = '\0'; + for (; *var; var = value + strlen(value) + 1) { +- eq = strchr(var, '='); ++ data_left = end - var; ++ ++ eq = strnchr(var, data_left, '='); + if (!eq) + break; + value = eq + 1; +-- +1.8.4.5 + -- cgit v1.2.3