* commands/cat.c (grub_cmd_cat): Fix buffer overrun if '\r' is the

last character in the buffer.
Reported by: Vladimir Serbinenko.

diff --git a/ChangeLog b/ChangeLog
index 46c0ee188bbab655727c3600317e6f9c68388f34..54880f44f6eaf0b73684fbc3aa26583ace4dd6e1 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2010-06-29  Colin Watson  <cjwatson@ubuntu.com>
+
+       * commands/cat.c (grub_cmd_cat): Fix buffer overrun if '\r' is the
+       last character in the buffer.
+       Reported by: Vladimir Serbinenko.
+
 2010-06-29  Robert Millan  <rmh@gnu.org>
 
        * docs/grub.texi (Simple configuration): Document ${GRUB_BADRAM}.

diff --git a/commands/cat.c b/commands/cat.c
index 4c0e19bc2d6bfbf08605e0d1c6fef99fec37cb1e..289cf7352b67a18e423a6f717963e5ebf61ba7e2 100644 (file)
--- a/commands/cat.c
+++ b/commands/cat.c
@@ -63,7 +63,7 @@ grub_cmd_cat (grub_extcmd_t cmd, int argc, char **args)
 
          if ((grub_isprint (c) || grub_isspace (c)) && c != '\r')
            grub_putchar (c);
-         else if (dos && c == '\r' && buf[i + 1] == '\n')
+         else if (dos && c == '\r' && i + 1 < size && buf[i + 1] == '\n')
            {
              grub_putchar ('\n');
              i++;