summaryrefslogtreecommitdiff
path: root/payloads/libpayload
diff options
context:
space:
mode:
authorVladimir Serbinenko <phcoder@gmail.com>2014-01-15 22:06:56 +0100
committerNico Huber <nico.h@gmx.de>2014-01-19 11:51:23 +0100
commit7ea00155b20db923833b8d3564c897b8ecf3fcc1 (patch)
treedee269d8f15ffdf667427adf5a9744b170894726 /payloads/libpayload
parentfd5b3704374c9ca7d57627f9d449536d02b9baf0 (diff)
downloadcoreboot-7ea00155b20db923833b8d3564c897b8ecf3fcc1.tar.xz
libpayload/options: Fix out of array read.
It resulted in garbage in upper bytes of numeric options. Change-Id: I5e5d8b770ed93c7e8a1756a5ce32444b6a045bac Signed-off-by: Vladimir Serbinenko <phcoder@gmail.com> Reviewed-on: http://review.coreboot.org/4691 Tested-by: build bot (Jenkins) Reviewed-by: Paul Menzel <paulepanter@users.sourceforge.net> Reviewed-by: Nico Huber <nico.h@gmx.de>
Diffstat (limited to 'payloads/libpayload')
-rw-r--r--payloads/libpayload/drivers/options.c4
1 files changed, 4 insertions, 0 deletions
diff --git a/payloads/libpayload/drivers/options.c b/payloads/libpayload/drivers/options.c
index d497c0aae6..70c2b1760d 100644
--- a/payloads/libpayload/drivers/options.c
+++ b/payloads/libpayload/drivers/options.c
@@ -310,6 +310,10 @@ int get_option_as_string(const struct nvram_accessor *nvram, struct cb_cmos_opti
return 1;
int cmos_length = (cmos_entry->length+7)/8;
+ /* ensure we have enough space for u64 */
+ if (cmos_length < 8)
+ cmos_length = 8;
+
/* extra byte to ensure 0-terminated strings */
raw = malloc(cmos_length+1);
memset(raw, 0, cmos_length+1);