mirror of
https://git.savannah.gnu.org/git/grub.git
synced 2026-10-21 14:59:34 +00:00
B Horn
0707accab1
An overly long filename can be passed to tftp_open() which would cause grub_normalize_filename() to write out of bounds. Fixed by adding an extra argument to grub_normalize_filename() for the space available, making it act closer to a strlcpy(). As several fixed strings are strcpy()'d after into the same buffer, their total length is checked to see if they exceed the remaining space in the buffer. If so, return an error. On the occasion simplify code a bit by removing unneeded rrqlen zeroing. Reported-by: B Horn <b@horn.uk> Signed-off-by: B Horn <b@horn.uk> Reviewed-by: Daniel Kiper <daniel.kiper@oracle.com>