In flat tree reading, check for (negative) string offsets which underrun

the input blob. (Patch from Michael Ellerman).
20 years ago · 4ddf7c020c
1 changed files with 1 additions and 1 deletions
--- a/flattree.c
+++ b/flattree.c
@ -547,7 +547,7 @@ static char *flat_read_stringtable(struct inbuf *inb, int offset)
				@@ -547,7 +547,7 @@ static char *flat_read_stringtable(struct inbuf *inb, int offset)

 	p = inb->base + offset;
 	while (1) {
-		if (p >= inb->limit)
+		if (p >= inb->limit || p < inb->base)
 			die("String offset %d overruns string table\n",
 			    offset);