util/nvmutil: add bound check to x_try_fdpath

Signed-off-by: Leah Rowe <leah@libreboot.org>

1 files changed, 6 insertions, 1 deletions

diff --git a/util/nvmutil/nvmutil.c b/util/nvmutil/nvmutil.c
index 66f18300..b40a0910 100644
--- a/util/nvmutil/nvmutil.c
+++ b/util/nvmutil/nvmutil.c
@@ -3232,13 +3232,18 @@ x_try_fdpath(const char *prefix, int fd, mode_t mode)
 	unsigned long j;
 
 	while (prefix[i]) {
+		if (i >= PATH_LEN - 1)
+			return -1;
 		path[i] = prefix[i];
 		i++;
 	}
 
 	j = x_conv_fd(path + i, (unsigned long)fd);
-	i += j;
 
+	if (i + j >= PATH_LEN)
+		return -1;
+
+	i += j;
 	path[i] = '\0';
 
 	return chmod(path, mode);