From 18da5c304219abce11add74e2df0e3e05dc5d48b Mon Sep 17 00:00:00 2001
From: PulkoMandy <pulkomandy@pulkomandy.tk>
Date: Tue, 17 Mar 2020 21:28:07 +0100
Subject: [PATCH] Bootloader log: check for buffer overflow

We could overflow the in-memory log. The bounds check was there for BIOS
already but was missing in EFI and openfirmware. Could fix some crashes
when there is lots of loging.
---
 src/system/boot/platform/efi/debug.cpp          | 2 ++
 src/system/boot/platform/openfirmware/debug.cpp | 6 ++++--
 2 files changed, 6 insertions(+), 2 deletions(-)

diff --git a/src/system/boot/platform/efi/debug.cpp b/src/system/boot/platform/efi/debug.cpp
index 9355c6a796..48724ad3ce 100644
--- a/src/system/boot/platform/efi/debug.cpp
+++ b/src/system/boot/platform/efi/debug.cpp
@@ -21,6 +21,8 @@ static uint32 sBufferPosition;
 static void
 syslog_write(const char* buffer, size_t length)
 {
+	if (sBufferPosition + length > sizeof(sBuffer))
+		return;
 	memcpy(sBuffer + sBufferPosition, buffer, length);
 	sBufferPosition += length;
 }
diff --git a/src/system/boot/platform/openfirmware/debug.cpp b/src/system/boot/platform/openfirmware/debug.cpp
index 78eb3cf132..0758f30dfe 100644
--- a/src/system/boot/platform/openfirmware/debug.cpp
+++ b/src/system/boot/platform/openfirmware/debug.cpp
@@ -17,9 +17,11 @@ static char sBuffer[16384];
 static uint32 sBufferPosition;
 
 
-static void
+static inline void
 syslog_write(const char* buffer, size_t length)
 {
+	if (sBufferPosition + length > sizeof(sBuffer))
+		return;
 	memcpy(sBuffer + sBufferPosition, buffer, length);
 	sBufferPosition += length;
 }
@@ -41,7 +43,7 @@ panic(const char* format, ...)
 }
 
 
-static void
+static inline void
 dprintf_args(const char *format, va_list args)
 {
 	char buffer[512];