[PATCH] Avoid buffer overflow for excessive layouts

[Carl-Daniel Hailfinger]

Stop reading layout info when the max layout count has been reached.

Signed-off-by: Carl-Daniel Hailfinger

Index: flashrom-layout_overflow/layout.c
===================================================================
--- flashrom-layout_overflow/layout.c	(Revision 1238)
+++ flashrom-layout_overflow/layout.c	(Arbeitskopie)
@@ -152,6 +152,14 @@

while (!feof(romlayout)) {
    	char *tstr1, *tstr2;
+
+		if (romimages >= MAX_ROMLAYOUT) {
+			msg_gerr("Maximum number of ROM images (%i) in layout "
+				 "file reached before end of layout file.\n",
+				 MAX_ROMLAYOUT);
+			msg_gerr("Ignoring the rest of the layout file.\n");
+			break;
+		}
    	if (2 != fscanf(romlayout, "%s %s\n", tempstr, rom_entries[romimages].name))
    		continue;
 #if 0

[Uwe Hermann]

On Thu, Dec 02, 2010 at 01:45:07PM +0100, Carl-Daniel Hailfinger wrote:
> Stop reading layout info when the max layout count has been reached.
>
> Signed-off-by: Carl-Daniel Hailfinger

Acked-by: Uwe Hermann

Uwe.

[Carl-Daniel Hailfinger]

On 04.12.2010 10:46, Uwe Hermann wrote:
> On Thu, Dec 02, 2010 at 01:45:07PM +0100, Carl-Daniel Hailfinger wrote:
> > Stop reading layout info when the max layout count has been reached.
> >
> > Signed-off-by: Carl-Daniel Hailfinger
>
> Acked-by: Uwe Hermann

Thanks, committed in r1243.

Regards,
Carl-Daniel