david/ipxe
david
/
ipxe
Archived
1
0
Fork 0
Code

[settings] Handle errors in fetchf_uristring() 

fetchf_uristring() was failing to handle error values from
fetch_setting(), resulting in its attempting to allocate extremely
large temporary buffers on the stack (and so overrunning the stack and
locking up the machine).

Problem reported by Shao Miller <Shao.Miller@yrdsb.edu.on.ca>.
This commit is contained in:
Michael Brown 2009-02-12 09:16:53 +00:00
parent 8e960eb67c
commit 4e6b62c946
1 changed files with 4 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
src/core/settings.c
View File

@ -825,12 +825,15 @@ static int storef_uristring ( struct settings *settings,
static int fetchf_uristring ( struct settings *settings,
struct setting *setting,
char *buf, size_t len ) {
size_t raw_len;
ssize_t raw_len;
/* We need to always retrieve the full raw string to know the
* length of the encoded string.
*/
raw_len = fetch_setting ( settings, setting, NULL, 0 );
if ( raw_len < 0 )
return raw_len;
{
char raw_buf[ raw_len + 1 ];