CVS commit: src/sys/dev/fdt

[Manuel Bouyer]

Module Name:    src
Committed By:   bouyer
Date:           Tue Mar  6 17:40:04 UTC 2018

Modified Files:
        src/sys/dev/fdt: fdt_subr.c

Log Message:
fdtbus_get_string_index(): decrease len when going to the next string,
otherwise we may read past the end of names.


To generate a diff of this commit:
cvs rdiff -u -r1.20 -r1.21 src/sys/dev/fdt/fdt_subr.c

Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.


Modified files:

Index: src/sys/dev/fdt/fdt_subr.c
diff -u src/sys/dev/fdt/fdt_subr.c:1.20 src/sys/dev/fdt/fdt_subr.c:1.21
--- src/sys/dev/fdt/fdt_subr.c:1.20	Sun Dec 10 21:38:27 2017
+++ src/sys/dev/fdt/fdt_subr.c	Tue Mar  6 17:40:04 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: fdt_subr.c,v 1.20 2017/12/10 21:38:27 skrll Exp $ */
+/* $NetBSD: fdt_subr.c,v 1.21 2018/03/06 17:40:04 bouyer Exp $ */
 
 /*-
  * Copyright (c) 2015 Jared D. McNeill <jmcne...@invisible.ca>
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: fdt_subr.c,v 1.20 2017/12/10 21:38:27 skrll Exp $");
+__KERNEL_RCSID(0, "$NetBSD: fdt_subr.c,v 1.21 2018/03/06 17:40:04 bouyer Exp $");
 
 #include <sys/param.h>
 #include <sys/bus.h>
@@ -467,7 +467,7 @@ fdtbus_get_string_index(int phandle, con
 	names = fdtbus_get_string(phandle, prop);
 
 	for (name = names, cur = 0; len > 0;
-	     name += strlen(name) + 1, cur++) {
+	     len -= strlen(name) + 1, name += strlen(name) + 1, cur++) {
 		if (index == cur)
 			return name;
 	}