Skip to content
Commit 7bae13da authored by Heinrich Schuchardt's avatar Heinrich Schuchardt Committed by Tom Rini
Browse files

cli: avoid buffer overrun



Invoking the sandbox with

    /u-boot -c ⧵0xef⧵0xbf⧵0xbd

results in a segmentation fault.

Function b_getch() retrieves a character from the input stream. This
character may be > 0x7f. If type char is signed, static_get() will
return a negative number and in parse_stream() we will use that
negative number as an index for array map[] resulting in a buffer
overflow.

Reported-by: default avatarHarry Lockyer <harry_lockyer@tutanota.com>
Signed-off-by: default avatarHeinrich Schuchardt <heinrich.schuchardt@canonical.com>
Reviewed-by: default avatarSimon Glass <sjg@chromium.org>
parent 1310ad3a
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment