[PATCH][libubootenv] uboot_env: Fix environment read bounds check on missing NUL terminator

[Christian Storm]

Check bounds before dereferencing in the outer and inner parsing
loops of a CRC-valid image, preventing reads past usable_envsize
on a missing NUL terminator.

In the old version,
for (line = data; *line; ...)
dereferences *line without checking if line is still within bounds.
Alike,
for (next = line; *next; ++next)
dereferences *next first and checks bounds thereafter.

Signed-off-by: Christian Storm <christi...@siemens.com>
---
src/uboot_env.c | 13 +++++++------
1 file changed, 7 insertions(+), 6 deletions(-)

diff --git a/src/uboot_env.c b/src/uboot_env.c
index 8830e4f..087cab6 100644
--- a/src/uboot_env.c
+++ b/src/uboot_env.c
@@ -725,17 +725,18 @@ static int libuboot_load(struct uboot_ctx *ctx)
char *flagsvar = NULL;

if (ctx->valid) {
- for (line = data; *line; line = next + 1) {
+ for (line = data; (line - data) < usable_envsize && *line; line = next + 1) {
char *value;

/*
* Search the end of the string pointed by line
*/
- for (next = line; *next; ++next) {
- if ((next - (char *)data) > usable_envsize) {
- free(buf[0]);
- return -EIO;
- }
+ for (next = line; (next - data) < usable_envsize && *next; ++next)
+ ;
+
+ if ((next - data) >= usable_envsize) {
+ free(buf[0]);
+ return -EIO;
}

value = strchr(line, '=');
--
2.55.0

[Stefano Babic]

Applied to -master, thanks !

Best regards,
Stefano

--
_______________________________________________________________________
Nabla Software Engineering GmbH
Hirschstr. 111A | 86156 Augsburg | Tel: +49 821 45592596
Geschäftsführer : Stefano Babic | HRB 40522 Augsburg
E-Mail: sba...@nabladev.com