Module Name: src
Committed By: bouyer
Date: Tue Mar 6 17:40:04 UTC 2018
Modified Files:
src/sys/dev/fdt: fdt_subr.c
Log Message:
fdtbus_get_string_index(): decrease len when going to the next string,
otherwise we may read past the end of names.
To generate a diff of this commit:
cvs rdiff -u -r1.20 -r1.21 src/sys/dev/fdt/fdt_subr.c
Please note that diffs are not public domain; they are subject to the
copyright notices on the relevant files.
Modified files:
Index: src/sys/dev/fdt/fdt_subr.c
diff -u src/sys/dev/fdt/fdt_subr.c:1.20 src/sys/dev/fdt/fdt_subr.c:1.21
--- src/sys/dev/fdt/fdt_subr.c:1.20 Sun Dec 10 21:38:27 2017
+++ src/sys/dev/fdt/fdt_subr.c Tue Mar 6 17:40:04 2018
@@ -1,4 +1,4 @@
-/* $NetBSD: fdt_subr.c,v 1.20 2017/12/10 21:38:27 skrll Exp $ */
+/* $NetBSD: fdt_subr.c,v 1.21 2018/03/06 17:40:04 bouyer Exp $ */
/*-
* Copyright (c) 2015 Jared D. McNeill <jmcne...@invisible.ca>
@@ -27,7 +27,7 @@
*/
#include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: fdt_subr.c,v 1.20 2017/12/10 21:38:27 skrll Exp $");
+__KERNEL_RCSID(0, "$NetBSD: fdt_subr.c,v 1.21 2018/03/06 17:40:04 bouyer Exp $");
#include <sys/param.h>
#include <sys/bus.h>
@@ -467,7 +467,7 @@ fdtbus_get_string_index(int phandle, con
names = fdtbus_get_string(phandle, prop);
for (name = names, cur = 0; len > 0;
- name += strlen(name) + 1, cur++) {
+ len -= strlen(name) + 1, name += strlen(name) + 1, cur++) {
if (index == cur)
return name;
}
