diff options
| author | Leah Rowe <leah@libreboot.org> | 2026-03-15 01:14:29 +0000 |
|---|---|---|
| committer | Leah Rowe <leah@libreboot.org> | 2026-03-26 06:59:41 +0000 |
| commit | a050e5a563819f09e9a65acae8773d43422e9f33 (patch) | |
| tree | e8681e5948d0d462416653eb7817efb5c5713969 | |
| parent | 8d81e8f68bd5c5af0bf67ae68ea0364773d237b9 (diff) | |
util/nvmutil: fix theoretical buffer overflow
i already guard offsets in io_args, but it's best
to be thorough here.
Signed-off-by: Leah Rowe <leah@libreboot.org>
| -rw-r--r-- | util/nvmutil/nvmutil.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/util/nvmutil/nvmutil.c b/util/nvmutil/nvmutil.c index d05d25ce..a869e604 100644 --- a/util/nvmutil/nvmutil.c +++ b/util/nvmutil/nvmutil.c @@ -1917,6 +1917,8 @@ rw_file_exact(int fd, u8 *mem, size_t nrw, mem_cur = (void *)(mem + (size_t)rc); nrw_cur = (size_t)(nrw - (size_t)rc); + if (off < 0) + goto err_rw_file_exact; off_cur = (off_t)((size_t)off + (size_t)rc); rv = prw(fd, mem_cur, nrw_cur, off_cur, |