efi: Fix out-of-bounds read in variable_matches()
authorLaszlo Ersek <lersek@redhat.com>
Thu, 21 Apr 2016 16:21:11 +0000 (18:21 +0200)
committerMatt Fleming <matt@codeblueprint.co.uk>
Fri, 22 Apr 2016 18:41:41 +0000 (19:41 +0100)
commit630ba0cc7a6dbafbdee43795617c872b35cde1b4
tree0dbc30e47cd62af70ac76630074d4a0d9c8581ff
parentc3b46c73264b03000d1e18b22f5caf63332547c9
efi: Fix out-of-bounds read in variable_matches()

The variable_matches() function can currently read "var_name[len]", for
example when:

 - var_name[0] == 'a',
 - len == 1
 - match_name points to the NUL-terminated string "ab".

This function is supposed to accept "var_name" inputs that are not
NUL-terminated (hence the "len" parameter"). Document the function, and
access "var_name[*match]" only if "*match" is smaller than "len".

Reported-by: Chris Wilson <chris@chris-wilson.co.uk>
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Cc: Peter Jones <pjones@redhat.com>
Cc: Matthew Garrett <mjg59@coreos.com>
Cc: Jason Andryuk <jandryuk@gmail.com>
Cc: Jani Nikula <jani.nikula@linux.intel.com>
Cc: <stable@vger.kernel.org> # v3.10+
Link: http://thread.gmane.org/gmane.comp.freedesktop.xorg.drivers.intel/86906
Signed-off-by: Matt Fleming <matt@codeblueprint.co.uk>
drivers/firmware/efi/vars.c