diff options
| author | Heinrich Schuchardt <[email protected]> | 2023-05-02 04:34:09 +0200 |
|---|---|---|
| committer | Tom Rini <[email protected]> | 2023-05-31 17:23:01 -0400 |
| commit | 7bae13da36477ce451ef5975e0cf79dbe035b52c (patch) | |
| tree | 8d2cf90e7e8af689f178237f068fcee64f274f28 /cmd | |
| parent | 1310ad3aacf5cae97a2f3457ec9ef56f0d88bc09 (diff) | |
cli: avoid buffer overrun
Invoking the sandbox with
/u-boot -c ⧵0xef⧵0xbf⧵0xbd
results in a segmentation fault.
Function b_getch() retrieves a character from the input stream. This
character may be > 0x7f. If type char is signed, static_get() will
return a negative number and in parse_stream() we will use that
negative number as an index for array map[] resulting in a buffer
overflow.
Reported-by: Harry Lockyer <[email protected]>
Signed-off-by: Heinrich Schuchardt <[email protected]>
Reviewed-by: Simon Glass <[email protected]>
Diffstat (limited to 'cmd')
0 files changed, 0 insertions, 0 deletions
