Module Name: src
Committed By: christos
Date: Wed Sep 6 18:21:17 UTC 2017
Modified Files:
src/sys/dev/dkwedge: dkwedge_gpt.c
Log Message:
PR/52522: ent_name is not necessarily 0 terminated, so check bounds.
XXX: pullup-8
To generate a diff of this commit:
cvs rdiff -u -r1.18 -r1.19 src/sys/dev/dkwedge/dkwedge_gpt.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/dkwedge/dkwedge_gpt.c
diff -u src/sys/dev/dkwedge/dkwedge_gpt.c:1.18 src/sys/dev/dkwedge/dkwedge_gpt.c:1.19
--- src/sys/dev/dkwedge/dkwedge_gpt.c:1.18 Wed Jan 18 19:44:40 2017
+++ src/sys/dev/dkwedge/dkwedge_gpt.c Wed Sep 6 14:21:17 2017
@@ -1,4 +1,4 @@
-/* $NetBSD: dkwedge_gpt.c,v 1.18 2017/01/19 00:44:40 maya Exp $ */
+/* $NetBSD: dkwedge_gpt.c,v 1.19 2017/09/06 18:21:17 christos Exp $ */
/*-
* Copyright (c) 2004 The NetBSD Foundation, Inc.
@@ -34,7 +34,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: dkwedge_gpt.c,v 1.18 2017/01/19 00:44:40 maya Exp $");
+__KERNEL_RCSID(0, "$NetBSD: dkwedge_gpt.c,v 1.19 2017/09/06 18:21:17 christos Exp $");
#include <sys/param.h>
#include <sys/systm.h>
@@ -252,7 +252,8 @@ dkwedge_discover_gpt(struct disk *pdk, s
else {
c = dkw.dkw_wname;
r = sizeof(dkw.dkw_wname) - 1;
- for (j = 0; ent->ent_name[j] != 0x0000; j++) {
+ for (j = 0; j < sizeof(ent->ent_name)
+ && ent->ent_name[j] != 0x0000; j++) {
n = wput_utf8(c, r, le16toh(ent->ent_name[j]));
if (n == 0)
break;
