From 5c76ed66b8ccbcf9bd6f868d0635a0c60d7c10e6 Mon Sep 17 00:00:00 2001 From: Nico Huber Date: Wed, 30 Jan 2019 14:29:42 +0100 Subject: libpayload/option table: Don't pad string entries with garbage set_option_with() expects a buffer of the exact size of the option. Change-Id: I21332394f88cf2daa4f733a544627d6d3c6ef26c Signed-off-by: Nico Huber Reviewed-on: https://review.coreboot.org/c/coreboot/+/31348 Tested-by: build bot (Jenkins) Reviewed-by: Patrick Georgi --- payloads/libpayload/drivers/options.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) (limited to 'payloads/libpayload') diff --git a/payloads/libpayload/drivers/options.c b/payloads/libpayload/drivers/options.c index 70c2b1760d..2b0a42e1b7 100644 --- a/payloads/libpayload/drivers/options.c +++ b/payloads/libpayload/drivers/options.c @@ -357,7 +357,11 @@ int set_option_from_string(const struct nvram_accessor *nvram, struct cb_cmos_op *(u64*)raw = strtoull(value, NULL, 0); break; case 's': - raw = strdup(value); + raw = malloc(cmos_entry->length); + if (!raw) + return 1; + memset(raw, 0x00, cmos_entry->length); + strncpy(raw, value, cmos_entry->length); break; case 'e': cmos_enum = lookup_cmos_enum_by_label(option_table, cmos_entry->config_id, value); -- cgit v1.2.3