|
 |
b15ea1 |
From 272b216e197b2b3d05da68ef51861545a36dc6d8 Mon Sep 17 00:00:00 2001
|
|
|
b15ea1 |
From: Peter Jones <pjones@redhat.com>
|
|
|
b15ea1 |
Date: Tue, 18 Jun 2019 15:54:58 -0400
|
|
|
b15ea1 |
Subject: [PATCH 39/86] Fix a case clang-analyzer found where we may try to
|
|
|
b15ea1 |
parse a NULL
|
|
|
b15ea1 |
|
|
|
b15ea1 |
I don't think this is something that can *actually* happen - it didn't
|
|
|
b15ea1 |
trigger before save_variable() was added, and the save_variable() path
|
|
|
b15ea1 |
that calls this calls validate_name() immediately prior to this call.
|
|
|
b15ea1 |
validate_name() calls exit() if it's NULL. But that's weird as well,
|
|
|
b15ea1 |
because that's the same pattern all the other users of parse_name() use.
|
|
|
b15ea1 |
|
|
|
b15ea1 |
Anyway, this patch expands validate_name() and moves it into
|
|
|
b15ea1 |
parse_name() so we don't need to call it from everywhere when we're just
|
|
|
b15ea1 |
calling the two in a row anyway.
|
|
|
b15ea1 |
|
|
|
b15ea1 |
Signed-off-by: Peter Jones <pjones@redhat.com>
|
|
|
b15ea1 |
---
|
|
|
b15ea1 |
src/efivar.c | 45 ++++++++++++++++++++++++++++++---------------
|
|
|
b15ea1 |
1 file changed, 30 insertions(+), 15 deletions(-)
|
|
|
b15ea1 |
|
|
|
b15ea1 |
diff --git a/src/efivar.c b/src/efivar.c
|
|
|
b15ea1 |
index 885a9af864b..8b1da8888f6 100644
|
|
|
b15ea1 |
--- a/src/efivar.c
|
|
|
b15ea1 |
+++ b/src/efivar.c
|
|
|
b15ea1 |
@@ -95,6 +95,34 @@ show_errors(void)
|
|
|
b15ea1 |
}
|
|
|
b15ea1 |
}
|
|
|
b15ea1 |
|
|
|
b15ea1 |
+static inline void
|
|
|
b15ea1 |
+validate_name(const char *name)
|
|
|
b15ea1 |
+{
|
|
|
b15ea1 |
+ if (name == NULL) {
|
|
|
b15ea1 |
+err:
|
|
|
b15ea1 |
+ warnx("Invalid variable name \"%s\"",
|
|
|
b15ea1 |
+ (name == NULL) ? "(null)" : name);
|
|
|
b15ea1 |
+ show_errors();
|
|
|
b15ea1 |
+ exit(1);
|
|
|
b15ea1 |
+ }
|
|
|
b15ea1 |
+ if (name[0] == '{') {
|
|
|
b15ea1 |
+ const char *next = strchr(name+1, '}');
|
|
|
b15ea1 |
+ if (!next)
|
|
|
b15ea1 |
+ goto err;
|
|
|
b15ea1 |
+ if (next[1] != '-')
|
|
|
b15ea1 |
+ goto err;
|
|
|
b15ea1 |
+ if (next[2] == '\000')
|
|
|
b15ea1 |
+ goto err;
|
|
|
b15ea1 |
+ } else {
|
|
|
b15ea1 |
+ if (strlen(name) < 38)
|
|
|
b15ea1 |
+ goto err;
|
|
|
b15ea1 |
+ if (name[8] != '-' || name[13] != '-' ||
|
|
|
b15ea1 |
+ name[18] != '-' || name[23] != '-' ||
|
|
|
b15ea1 |
+ name[36] != '-')
|
|
|
b15ea1 |
+ goto err;
|
|
|
b15ea1 |
+ }
|
|
|
b15ea1 |
+}
|
|
|
b15ea1 |
+
|
|
|
b15ea1 |
static void
|
|
|
b15ea1 |
list_all_variables(void)
|
|
|
b15ea1 |
{
|
|
|
b15ea1 |
@@ -124,6 +152,8 @@ parse_name(const char *guid_name, char **name, efi_guid_t *guid)
|
|
|
b15ea1 |
|
|
|
b15ea1 |
const char *left, *right;
|
|
|
b15ea1 |
|
|
|
b15ea1 |
+ validate_name(guid_name);
|
|
|
b15ea1 |
+
|
|
|
b15ea1 |
left = strchr(guid_name, '{');
|
|
|
b15ea1 |
right = strchr(guid_name, '}');
|
|
|
b15ea1 |
if (left && right) {
|
|
|
b15ea1 |
@@ -408,16 +438,6 @@ edit_variable(const char *guid_name, void *data, size_t data_size,
|
|
|
b15ea1 |
}
|
|
|
b15ea1 |
}
|
|
|
b15ea1 |
|
|
|
b15ea1 |
-static void
|
|
|
b15ea1 |
-validate_name(const char *name)
|
|
|
b15ea1 |
-{
|
|
|
b15ea1 |
- if (name == NULL) {
|
|
|
b15ea1 |
- fprintf(stderr, "Invalid variable name\n");
|
|
|
b15ea1 |
- show_errors();
|
|
|
b15ea1 |
- exit(1);
|
|
|
b15ea1 |
- }
|
|
|
b15ea1 |
-}
|
|
|
b15ea1 |
-
|
|
|
b15ea1 |
static void
|
|
|
b15ea1 |
prepare_data(const char *filename, uint8_t **data, size_t *data_size)
|
|
|
b15ea1 |
{
|
|
|
b15ea1 |
@@ -588,21 +608,17 @@ int main(int argc, char *argv[])
|
|
|
b15ea1 |
list_all_variables();
|
|
|
b15ea1 |
break;
|
|
|
b15ea1 |
case ACTION_PRINT:
|
|
|
b15ea1 |
- validate_name(guid_name);
|
|
|
b15ea1 |
show_variable(guid_name, SHOW_VERBOSE);
|
|
|
b15ea1 |
break;
|
|
|
b15ea1 |
case ACTION_PRINT_DEC | ACTION_PRINT:
|
|
|
b15ea1 |
- validate_name(guid_name);
|
|
|
b15ea1 |
show_variable(guid_name, SHOW_DECIMAL);
|
|
|
b15ea1 |
break;
|
|
|
b15ea1 |
case ACTION_APPEND | ACTION_PRINT:
|
|
|
b15ea1 |
- validate_name(guid_name);
|
|
|
b15ea1 |
prepare_data(infile, &data, &data_size);
|
|
|
b15ea1 |
edit_variable(guid_name, data, data_size, attributes,
|
|
|
b15ea1 |
EDIT_APPEND);
|
|
|
b15ea1 |
break;
|
|
|
b15ea1 |
case ACTION_WRITE | ACTION_PRINT:
|
|
|
b15ea1 |
- validate_name(guid_name);
|
|
|
b15ea1 |
prepare_data(infile, &data, &data_size);
|
|
|
b15ea1 |
edit_variable(guid_name, data, data_size, attributes,
|
|
|
b15ea1 |
EDIT_WRITE);
|
|
|
b15ea1 |
@@ -653,7 +669,6 @@ int main(int argc, char *argv[])
|
|
|
b15ea1 |
|
|
|
b15ea1 |
efi_variable_free(var, false);
|
|
|
b15ea1 |
} else {
|
|
|
b15ea1 |
- validate_name(guid_name);
|
|
|
b15ea1 |
save_variable(guid_name, outfile, dmpstore);
|
|
|
b15ea1 |
}
|
|
|
b15ea1 |
break;
|
|
|
b15ea1 |
--
|
|
|
b15ea1 |
2.24.1
|
|
|
b15ea1 |
|