brcm47xx: backport MIPS BCM47XX patches queued for 4.1
[openwrt/svn-archive/archive.git] / target / linux / brcm47xx / patches-3.18 / 031-04-MIPS-BCM47XX-Use-strnchr-to-avoid-reading-out-of-the.patch
1 From 80aaaa8b93d860f828e2cf883f307894640765f0 Mon Sep 17 00:00:00 2001
2 From: =?UTF-8?q?Rafa=C5=82=20Mi=C5=82ecki?= <zajec5@gmail.com>
3 Date: Wed, 10 Dec 2014 11:49:54 +0100
4 Subject: [PATCH] MIPS: BCM47XX: Use strnchr to avoid reading out of the buffer
5 MIME-Version: 1.0
6 Content-Type: text/plain; charset=UTF-8
7 Content-Transfer-Encoding: 8bit
8
9 Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
10 Cc: Hauke Mehrtens <hauke@hauke-m.de>
11 Cc: Paul Walmsley <paul@pwsan.com>
12 Cc: linux-mips@linux-mips.org
13 Patchwork: https://patchwork.linux-mips.org/patch/8662/
14 Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
15 ---
16 arch/mips/bcm47xx/nvram.c | 6 ++++--
17 1 file changed, 4 insertions(+), 2 deletions(-)
18
19 diff --git a/arch/mips/bcm47xx/nvram.c b/arch/mips/bcm47xx/nvram.c
20 index 5e4ae04..d805d8a 100644
21 --- a/arch/mips/bcm47xx/nvram.c
22 +++ b/arch/mips/bcm47xx/nvram.c
23 @@ -175,7 +175,7 @@ static int nvram_init(void)
24 int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
25 {
26 char *var, *value, *end, *eq;
27 - int err;
28 + int data_left, err;
29
30 if (!name)
31 return -EINVAL;
32 @@ -191,7 +191,9 @@ int bcm47xx_nvram_getenv(const char *name, char *val, size_t val_len)
33 end = nvram_buf + sizeof(nvram_buf) - 2;
34 end[0] = end[1] = '\0';
35 for (; *var; var = value + strlen(value) + 1) {
36 - eq = strchr(var, '=');
37 + data_left = end - var;
38 +
39 + eq = strnchr(var, data_left, '=');
40 if (!eq)
41 break;
42 value = eq + 1;
43 --
44 1.8.4.5
45