2008-05-29 Pavel Roskin <proski@gnu.org>

	* disk/lvm.c (grub_lvm_scan_device): Check for the buffer end
	when scanning metadata for volume group name.

diff --git a/ChangeLog b/ChangeLog
index 90536390c0f3c24492b3bbbf7700f649a9b708b6..eec4edcd17bb3ee0e160993f38016216d2521fcd 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,5 +1,8 @@
 2008-05-29  Pavel Roskin  <proski@gnu.org>
 
+       * disk/lvm.c (grub_lvm_scan_device): Check for the buffer end
+       when scanning metadata for volume group name.
+
        * include/grub/script.h: Don't include grub_script.tab.h.  It's
        a generated file, which may only be included from the files with
        DEPENDENCIES rules in the makefile.  Don't use typedef YYSTYPE,

diff --git a/disk/lvm.c b/disk/lvm.c
index 1d898ff55b48003c24e8a4958993579e2401df5f..997d15cd5ea05e8977968474db6b9539c61b110d 100644 (file)
--- a/disk/lvm.c
+++ b/disk/lvm.c
@@ -302,9 +302,12 @@ grub_lvm_scan_device (const char *name)
   rlocn = mdah->raw_locns;
   p = q = metadatabuf + grub_le_to_cpu64 (rlocn->offset);
 
-  while (*q != ' ')
+  while (*q != ' ' && q < metadatabuf + mda_size)
     q++;
 
+  if (q == metadatabuf + mda_size)
+    goto fail2;
+
   vgname_len = q - p;
   vgname = grub_malloc (vgname_len + 1);
   if (!vgname)