]> git.ipfire.org Git - thirdparty/ipxe.git/commitdiff
[script] Avoid using stack-allocated memory in process_line()
authorMichael Brown <mcb30@ipxe.org>
Mon, 23 Apr 2012 21:42:10 +0000 (22:42 +0100)
committerMichael Brown <mcb30@ipxe.org>
Mon, 23 Apr 2012 21:42:10 +0000 (22:42 +0100)
Script lines can be arbitrarily long; allocate on the heap rather than
on the stack.

Signed-off-by: Michael Brown <mcb30@ipxe.org>
src/image/script.c

index 460fbf03a414fa54912e4bef2a8a5c928f919bba..b032d18f1d064de201294ccc4323162c7100cae2 100644 (file)
@@ -58,6 +58,7 @@ static int process_script ( struct image *image,
                            int ( * terminate ) ( int rc ) ) {
        off_t eol;
        size_t len;
+       char *line;
        int rc;
 
        script_offset = 0;
@@ -71,23 +72,23 @@ static int process_script ( struct image *image,
                        eol = image->len;
                len = ( eol - script_offset );
 
-               /* Copy line, terminate with NUL, and execute command */
-               {
-                       char cmdbuf[ len + 1 ];
+               /* Allocate buffer for line */
+               line = zalloc ( len + 1 /* NUL */ );
+               if ( ! line )
+                       return -ENOMEM;
 
-                       copy_from_user ( cmdbuf, image->data,
-                                        script_offset, len );
-                       cmdbuf[len] = '\0';
-                       DBG ( "$ %s\n", cmdbuf );
+               /* Copy line */
+               copy_from_user ( line, image->data, script_offset, len );
+               DBG ( "$ %s\n", line );
 
-                       /* Move to next line */
-                       script_offset += ( len + 1 );
+               /* Move to next line */
+               script_offset += ( len + 1 );
 
-                       /* Process line */
-                       rc = process_line ( cmdbuf );
-                       if ( terminate ( rc ) )
-                               return rc;
-               }
+               /* Process and free line */
+               rc = process_line ( line );
+               free ( line );
+               if ( terminate ( rc ) )
+                       return rc;
 
        } while ( script_offset < image->len );