boot: Fix OOB reads in conf/osrel parsing

diff --git a/src/boot/efi/efi-string.c b/src/boot/efi/efi-string.c
index acb891a98e794b787ad03242a64e04ec304417b6..4144c0d49797e9e34c2c8b9ac025d58372b6e0ad 100644 (file)
--- a/src/boot/efi/efi-string.c
+++ b/src/boot/efi/efi-string.c
@@ -444,7 +444,7 @@ char *line_get_key_value(char *s, const char *sep, size_t *pos, char **ret_key,
                 line[linelen] = '\0';
 
                 /* remove leading whitespace */
-                while (strchr8(" \t", *line)) {
+                while (linelen > 0 && strchr8(" \t", *line)) {
                         line++;
                         linelen--;
                 }

diff --git a/src/boot/efi/test-efi-string.c b/src/boot/efi/test-efi-string.c
index f7964e03787ebfc6dc5b1dfee974fd5ce8c48926..b71a0c3402591d7e2b422bfa5daab92252877c36 100644 (file)
--- a/src/boot/efi/test-efi-string.c
+++ b/src/boot/efi/test-efi-string.c
@@ -520,7 +520,9 @@ TEST(line_get_key_value) {
         char *key, *value;
 
         assert_se(!line_get_key_value((char[]){ "" }, "=", &pos, &key, &value));
+        assert_se(!line_get_key_value((char[]){ "\t" }, " \t", &pos, &key, &value));
 
+        pos = 0;
         assert_se(line_get_key_value(s1, "=", &pos, &key, &value));
         assert_se(streq8(key, "key"));
         assert_se(streq8(value, "value"));