parse_label() takes an initrd= filename embedded in an append line
and computes its length as strchr(s, ' ') - s. When initrd= is the
last token, the append line ends at newline, so there is no blank
after the filename. strchr() returns NULL, the pointer subtraction
is not a length, and malloc() and strncpy() use an invalid size.
If strchr() finds no space, use strlen(s) as the length.
Fixes: 34bd23e42f3b ("pxe: parse initrd file from append string")
Signed-off-by: Suraj Kakade <[email protected]>
---
boot/pxe_utils.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/boot/pxe_utils.c b/boot/pxe_utils.c
index 8c1310dabeb..d4c57ff11f9 100644
--- a/boot/pxe_utils.c
+++ b/boot/pxe_utils.c
@@ -1285,6 +1285,7 @@ static int parse_label_kernel(char **c, struct pxe_label
*label)
static int parse_label(char **c, struct pxe_menu *cfg)
{
struct token t;
+ char *end;
int len;
char *s = *c;
struct pxe_label *label;
@@ -1326,7 +1327,8 @@ static int parse_label(char **c, struct pxe_menu *cfg)
if (!s)
break;
s += 7;
- len = (int)(strchr(s, ' ') - s);
+ end = strchr(s, ' ');
+ len = end ? (int)(end - s) : (int)strlen(s);
label->initrd = malloc(len + 1);
strncpy(label->initrd, s, len);
label->initrd[len] = '\0';
--
2.43.7
