Mercurial > illumos > illumos-gate
changeset 13678:8f2b5c7a4c80
2658 scf_get_bootconfig will indirectly stomp caller memory
Reviewed by: Dan McDonald <danmcd@nexenta.com>
Reviewed by: Robert Mustacchi <rm@joyent.com>
Reviewed by: T. Nguyen <truongqnguien@gmail.com>
Approved by: Gordon Ross <gwr@nexenta.com>
| author | Richard Lowe <richlowe@richlowe.net> |
|---|---|
| date | Fri, 27 Apr 2012 17:48:39 +0100 |
| parents | a0cbef703c12 |
| children | 1b5898b11b55 |
| files | usr/src/lib/libscf/common/highlevel.c |
| diffstat | 1 files changed, 5 insertions(+), 3 deletions(-) [+] |
line wrap: on
line diff
--- a/usr/src/lib/libscf/common/highlevel.c Fri Apr 27 11:14:46 2012 -0700 +++ b/usr/src/lib/libscf/common/highlevel.c Fri Apr 27 17:48:39 2012 +0100 @@ -159,6 +159,8 @@ void scf_get_boot_config(uint8_t *boot_config) { + uint64_t ret = 0; + assert(boot_config); *boot_config = 0; @@ -176,7 +178,7 @@ scf_propvec_t *prop; for (prop = ua_boot_config; prop->pv_prop != NULL; prop++) - prop->pv_ptr = boot_config; + prop->pv_ptr = &ret; prop = NULL; if (scf_read_propvec(FMRI_BOOT_CONFIG, BOOT_CONFIG_PG_PARAMS, B_TRUE, ua_boot_config, &prop) != SCF_FAILED) { @@ -187,9 +189,9 @@ * blacklisted. */ if (scf_is_fb_blacklisted()) - *boot_config &= ~(UA_FASTREBOOT_DEFAULT | - UA_FASTREBOOT_ONPANIC); + return; #endif /* __x86 */ + *boot_config = (uint8_t)ret; return; } #if defined(FASTREBOOT_DEBUG)