mirror of
https://git.FreeBSD.org/src.git
synced 2024-10-19 02:29:40 +00:00
09cb8031b4
If cnt == 0 we access element 0 unconditionally, which is out of bounds,
and then if that doesn't crash and happens to be 0 we will access
element - 1, also out of bounds, and then if that doesn't crash will add
1 to whatever junk is there and use that for the variable. On CHERI,
though, this does crash. This code is also overly complicated, with
unnecessary special cases and tracking more state than needed.
Rewrite it in a more general manner that doesn't need those special
cases and naturally works for cnt == 0.
Found by: CHERI
Reviewed by: imp
Fixes:
|
||
---|---|---|
.. | ||
efibootmgr.8 | ||
efibootmgr.c | ||
Makefile |