Module Name: src Committed By: christos Date: Wed Sep 6 18:21:17 UTC 2017
Modified Files: src/sys/dev/dkwedge: dkwedge_gpt.c Log Message: PR/52522: ent_name is not necessarily 0 terminated, so check bounds. XXX: pullup-8 To generate a diff of this commit: cvs rdiff -u -r1.18 -r1.19 src/sys/dev/dkwedge/dkwedge_gpt.c Please note that diffs are not public domain; they are subject to the copyright notices on the relevant files.
Modified files: Index: src/sys/dev/dkwedge/dkwedge_gpt.c diff -u src/sys/dev/dkwedge/dkwedge_gpt.c:1.18 src/sys/dev/dkwedge/dkwedge_gpt.c:1.19 --- src/sys/dev/dkwedge/dkwedge_gpt.c:1.18 Wed Jan 18 19:44:40 2017 +++ src/sys/dev/dkwedge/dkwedge_gpt.c Wed Sep 6 14:21:17 2017 @@ -1,4 +1,4 @@ -/* $NetBSD: dkwedge_gpt.c,v 1.18 2017/01/19 00:44:40 maya Exp $ */ +/* $NetBSD: dkwedge_gpt.c,v 1.19 2017/09/06 18:21:17 christos Exp $ */ /*- * Copyright (c) 2004 The NetBSD Foundation, Inc. @@ -34,7 +34,7 @@ */ #include <sys/cdefs.h> -__KERNEL_RCSID(0, "$NetBSD: dkwedge_gpt.c,v 1.18 2017/01/19 00:44:40 maya Exp $"); +__KERNEL_RCSID(0, "$NetBSD: dkwedge_gpt.c,v 1.19 2017/09/06 18:21:17 christos Exp $"); #include <sys/param.h> #include <sys/systm.h> @@ -252,7 +252,8 @@ dkwedge_discover_gpt(struct disk *pdk, s else { c = dkw.dkw_wname; r = sizeof(dkw.dkw_wname) - 1; - for (j = 0; ent->ent_name[j] != 0x0000; j++) { + for (j = 0; j < sizeof(ent->ent_name) + && ent->ent_name[j] != 0x0000; j++) { n = wput_utf8(c, r, le16toh(ent->ent_name[j])); if (n == 0) break;