boot: Fix off-by-one NUL-termination

diff --git a/src/boot/efi/bcd.c b/src/boot/efi/bcd.c
index 970c8b1c8ec3f701735274ac582a863e8d8b812b..1f9f19ba639505655c0b9ee1c32f444cd828e5a6 100644 (file)
--- a/src/boot/efi/bcd.c
+++ b/src/boot/efi/bcd.c
@@ -316,6 +316,6 @@ TEST_STATIC CHAR16 *get_bcd_title(UINT8 *bcd, UINTN bcd_len) {
 
         /* The data should already be NUL-terminated. */
         CHAR16 *title = (CHAR16 *) (bcd + description_value->data_offset);
-        title[description_value->data_size / sizeof(CHAR16)] = '\0';
+        title[description_value->data_size / sizeof(CHAR16) - 1] = '\0';
         return title;
 }

diff --git a/src/boot/efi/util.c b/src/boot/efi/util.c
index 6db4ab39695156aadaf7aea92c8cacada65e2d50..76e4eef1eb5de2b425c5ddc3a3d6bd0f14725c7e 100644 (file)
--- a/src/boot/efi/util.c
+++ b/src/boot/efi/util.c
@@ -174,7 +174,7 @@ EFI_STATUS efivar_get(const EFI_GUID *vendor, const CHAR16 *name, CHAR16 **value
                 return EFI_SUCCESS;
 
         /* Return buffer directly if it happens to be NUL terminated already */
-        if (size >= sizeof(CHAR16) && buf[size/sizeof(CHAR16)] == 0) {
+        if (size >= sizeof(CHAR16) && buf[size / sizeof(CHAR16) - 1] == 0) {
                 *value = TAKE_PTR(buf);
                 return EFI_SUCCESS;
         }
@@ -183,7 +183,7 @@ EFI_STATUS efivar_get(const EFI_GUID *vendor, const CHAR16 *name, CHAR16 **value
         val = xallocate_pool(size + sizeof(CHAR16));
 
         CopyMem(val, buf, size);
-        val[size / sizeof(CHAR16)] = 0; /* NUL terminate */
+        val[size / sizeof(CHAR16) - 1] = 0; /* NUL terminate */
 
         *value = val;
         return EFI_SUCCESS;