* grub-core/fs/udf.c (read_string): Bail out on size=0.

	(grub_udf_read_symlink): Handle read_string failure.

diff --git a/ChangeLog b/ChangeLog
index c451e128a526b179320a8880bc451c87a5846cf1..9bdba7c8af3092197f47a515b56fcdb1cddc4c9c 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,8 @@
+2012-05-12  Vladimir Serbinenko  <phcoder@gmail.com>
+
+       * grub-core/fs/udf.c (read_string): Bail out on size=0.
+       (grub_udf_read_symlink): Handle read_string failure.
+
 2012-05-12  Vladimir Serbinenko  <phcoder@gmail.com>
 
        * grub-core/kern/emu/hostdisk.c (read_device_map): Improve TRANSLATORS

diff --git a/grub-core/fs/udf.c b/grub-core/fs/udf.c
index 841667c23ed401e88cb8871ab4b39f2851a2156f..8e28d41e28a70446dabae1f4ab60ada16d069092 100644 (file)
--- a/grub-core/fs/udf.c
+++ b/grub-core/fs/udf.c
@@ -807,6 +807,9 @@ read_string (const grub_uint8_t *raw, grub_size_t sz, char *outbuf)
   grub_uint16_t *utf16 = NULL;
   grub_size_t utf16len = 0;
 
+  if (sz == 0)
+    return NULL;
+
   if (raw[0] != 8 && raw[0] != 16)
     return NULL;
 
@@ -989,7 +992,8 @@ grub_udf_read_symlink (grub_fshelp_node_t node)
          /* in 4 + n bytes. out, at most: 1 + 2 * n bytes.  */
          if (optr != out)
            *optr++ = '/';
-         read_string (ptr + 4, s - 4, optr);
+         if (!read_string (ptr + 4, s - 4, optr))
+           goto fail;
          optr += grub_strlen (optr);
          break;
        default: