From: David Tardon <dtardon@redhat.com>
Date: Wed, 10 Oct 2018 12:54:05 +0000 (+0200)
Subject: efivars: check path_len before using it as loop boundary
X-Git-Tag: v240~563^2
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=refs%2Fpull%2F10356%2Fhead;p=thirdparty%2Fsystemd.git

efivars: check path_len before using it as loop boundary
---

diff --git a/src/shared/efivars.c b/src/shared/efivars.c
index 3931bee5598..da70e68c816 100644
--- a/src/shared/efivars.c
+++ b/src/shared/efivars.c
@@ -412,9 +412,13 @@ int efi_get_boot_option(
 
         if (header->path_len > 0) {
                 uint8_t *dbuf;
-                size_t dnext;
+                size_t dnext, doff;
+
+                doff = offsetof(struct boot_option, title) + title_size;
+                dbuf = buf + doff;
+                if (header->path_len > l - doff)
+                        return -EINVAL;
 
-                dbuf = buf + offsetof(struct boot_option, title) + title_size;
                 dnext = 0;
                 while (dnext < header->path_len) {
                         struct device_path *dpath;