Commit 560f763b authored by Josh Law's avatar Josh Law Committed by Masami Hiramatsu (Google)
Browse files

lib/bootconfig: check bounds before writing in __xbc_open_brace() 

The bounds check for brace_index happens after the array write.
While the current call pattern prevents an actual out-of-bounds
access (the previous call would have returned an error), the
write-before-check pattern is fragile and would become a real
out-of-bounds write if the error return were ever not propagated.

Move the bounds check before the array write so the function is
self-contained and safe regardless of caller behavior.

Link: https://lore.kernel.org/all/20260312191143.28719-3-objecting@objecting.org/



Fixes: ead1e19a ("lib/bootconfig: Fix a bug of breaking existing tree nodes")
Cc: stable@vger.kernel.org
Signed-off-by: default avatarJosh Law <objecting@objecting.org>
Signed-off-by: default avatarMasami Hiramatsu (Google) <mhiramat@kernel.org>
parent 39ebc8d7

lib/bootconfig.c

+1 −1
Original line number Diff line number Diff line
@@ -532,9 +532,9 @@ static char *skip_spaces_until_newline(char *p) 
static int __init __xbc_open_brace(char *p)

{

	/* Push the last key as open brace */

	open_brace[brace_index++] = xbc_node_index(last_parent);

	if (brace_index >= XBC_DEPTH_MAX)

		return xbc_parse_error("Exceed max depth of braces", p);

	open_brace[brace_index++] = xbc_node_index(last_parent);



	return 0;

}