From: Colin Watson <cjwatson@ubuntu.com>
Date: Tue, 29 Jun 2010 15:15:46 +0000 (+0100)
Subject: * commands/cat.c (grub_cmd_cat): Fix buffer overrun if '\r' is the
X-Git-Tag: 1.99~783
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=1ba9b889469abd684e6f6e9519a17565dcf0e394;p=thirdparty%2Fgrub.git

* commands/cat.c (grub_cmd_cat): Fix buffer overrun if '\r' is the
last character in the buffer.
Reported by: Vladimir Serbinenko.
---

diff --git a/ChangeLog b/ChangeLog
index 46c0ee188..54880f44f 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2010-06-29  Colin Watson  <cjwatson@ubuntu.com>
+
+	* commands/cat.c (grub_cmd_cat): Fix buffer overrun if '\r' is the
+	last character in the buffer.
+	Reported by: Vladimir Serbinenko.
+
 2010-06-29  Robert Millan  <rmh@gnu.org>
 
 	* docs/grub.texi (Simple configuration): Document ${GRUB_BADRAM}.
diff --git a/commands/cat.c b/commands/cat.c
index 4c0e19bc2..289cf7352 100644
--- a/commands/cat.c
+++ b/commands/cat.c
@@ -63,7 +63,7 @@ grub_cmd_cat (grub_extcmd_t cmd, int argc, char **args)
 
 	  if ((grub_isprint (c) || grub_isspace (c)) && c != '\r')
 	    grub_putchar (c);
-	  else if (dos && c == '\r' && buf[i + 1] == '\n')
+	  else if (dos && c == '\r' && i + 1 < size && buf[i + 1] == '\n')
 	    {
 	      grub_putchar ('\n');
 	      i++;