util/nvmutil: prevent overflow in rw_file_exact

Signed-off-by: Leah Rowe <leah@libreboot.org>

1 files changed, 4 insertions, 0 deletions

diff --git a/util/nvmutil/nvmutil.c b/util/nvmutil/nvmutil.c
index 37d7c632..2d602038 100644
--- a/util/nvmutil/nvmutil.c
+++ b/util/nvmutil/nvmutil.c
@@ -1860,6 +1860,10 @@ rw_file_exact(int fd, u8 *mem, size_t nrw,
 			return -1;
 		}
 
+		/* Prevent theoretical overflow */
+		if (rv > nrw - rc)
+			goto err_rw_file_exact;
+
 		rc += (size_t)rv;
 	}