|
 |
003958 |
From 6077051e173770cf357703a3d776ceac2c53d963 Mon Sep 17 00:00:00 2001
|
|
|
003958 |
From: Richard Hughes <richard@hughsie.com>
|
|
|
003958 |
Date: Mon, 8 Feb 2021 18:10:38 +0000
|
|
|
003958 |
Subject: [PATCH 10/11] ihex: Fix a buffer-overread spotted by AddressSanitizer
|
|
|
003958 |
|
|
|
003958 |
---
|
|
|
003958 |
libfwupdplugin/fu-ihex-firmware.c | 8 +++-----
|
|
|
003958 |
1 file changed, 3 insertions(+), 5 deletions(-)
|
|
|
003958 |
|
|
|
003958 |
diff --git libfwupdplugin/fu-ihex-firmware.c libfwupdplugin/fu-ihex-firmware.c
|
|
|
003958 |
index 8d4fc6a6..5df8a948 100644
|
|
|
003958 |
--- libfwupdplugin/fu-ihex-firmware.c
|
|
|
003958 |
+++ libfwupdplugin/fu-ihex-firmware.c
|
|
|
003958 |
@@ -90,11 +90,6 @@ fu_ihex_firmware_record_new (guint ln, const gchar *line,
|
|
|
003958 |
rcd->ln = ln;
|
|
|
003958 |
rcd->data = g_byte_array_new ();
|
|
|
003958 |
rcd->buf = g_string_new (line);
|
|
|
003958 |
- rcd->byte_cnt = fu_firmware_strparse_uint8 (line + 1);
|
|
|
003958 |
- rcd->addr = fu_firmware_strparse_uint16 (line + 3);
|
|
|
003958 |
- rcd->record_type = fu_firmware_strparse_uint8 (line + 7);
|
|
|
003958 |
-
|
|
|
003958 |
- /* check there's enough data for the smallest possible record */
|
|
|
003958 |
if (rcd->buf->len < 11) {
|
|
|
003958 |
g_set_error (error,
|
|
|
003958 |
FWUPD_ERROR,
|
|
|
003958 |
@@ -103,6 +98,9 @@ fu_ihex_firmware_record_new (guint ln, const gchar *line,
|
|
|
003958 |
(guint) rcd->buf->len);
|
|
|
003958 |
return NULL;
|
|
|
003958 |
}
|
|
|
003958 |
+ rcd->byte_cnt = fu_firmware_strparse_uint8 (line + 1);
|
|
|
003958 |
+ rcd->addr = fu_firmware_strparse_uint16 (line + 3);
|
|
|
003958 |
+ rcd->record_type = fu_firmware_strparse_uint8 (line + 7);
|
|
|
003958 |
|
|
|
003958 |
/* position of checksum */
|
|
|
003958 |
line_end = 9 + rcd->byte_cnt * 2;
|
|
|
003958 |
--
|
|
|
003958 |
2.29.2
|
|
|
003958 |
|