diff options
| author | Leah Rowe <leah@libreboot.org> | 2026-03-12 16:34:33 +0000 |
|---|---|---|
| committer | Leah Rowe <leah@libreboot.org> | 2026-03-12 16:34:33 +0000 |
| commit | ab9ee73350d12429a122101b15ef677c39a9e8dc (patch) | |
| tree | 9d3a243391c4fc1c3eec63640ce8a9eb3bdd6c3e /util | |
| parent | 303c382eae77fbca2c087db9c6597a7c2d6658ec (diff) | |
util/nvmutil: mitigate buggy libc i/o
Signed-off-by: Leah Rowe <leah@libreboot.org>
Diffstat (limited to 'util')
| -rw-r--r-- | util/nvmutil/nvmutil.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/util/nvmutil/nvmutil.c b/util/nvmutil/nvmutil.c index 240cb73d..8448edc0 100644 --- a/util/nvmutil/nvmutil.c +++ b/util/nvmutil/nvmutil.c @@ -1480,6 +1480,12 @@ read_again: * cause an overflow. Specifications guarantee * this won't happen, but spec != implementation */ + if ((size_t)rv > SSIZE_MAX) { + errno = EIO; + return -1; + /* we will not tolerate your buggy libc */ + } + if ((size_t)rv > (len - rc) /* Prevent overflow */ || rv == 0) { /* Prevent infinite 0-byte loop */ if (rv == 0) { |