[src/trunk]: src/sys/dev/fdt fdtbus_get_string_index(): decrease len when goi...

[bouyer <bouyer%NetBSD.org@localhost>]

details:   https://anonhg.NetBSD.org/src/rev/dfde75c6e3d5
branches:  trunk
changeset: 321212:dfde75c6e3d5
user:      bouyer <bouyer%NetBSD.org@localhost>
date:      Tue Mar 06 17:40:04 2018 +0000

description:
fdtbus_get_string_index(): decrease len when going to the next string,
otherwise we may read past the end of names.

diffstat:

 sys/dev/fdt/fdt_subr.c |  6 +++---
 1 files changed, 3 insertions(+), 3 deletions(-)

diffs (27 lines):

diff -r 665f8f0559e8 -r dfde75c6e3d5 sys/dev/fdt/fdt_subr.c
--- a/sys/dev/fdt/fdt_subr.c    Tue Mar 06 17:39:36 2018 +0000
+++ b/sys/dev/fdt/fdt_subr.c    Tue Mar 06 17:40:04 2018 +0000
@@ -1,4 +1,4 @@
-/* $NetBSD: fdt_subr.c,v 1.20 2017/12/10 21:38:27 skrll Exp $ */
+/* $NetBSD: fdt_subr.c,v 1.21 2018/03/06 17:40:04 bouyer Exp $ */
 
 /*-
  * Copyright (c) 2015 Jared D. McNeill <jmcneill%invisible.ca@localhost>
@@ -27,7 +27,7 @@
  */
 
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: fdt_subr.c,v 1.20 2017/12/10 21:38:27 skrll Exp $");
+__KERNEL_RCSID(0, "$NetBSD: fdt_subr.c,v 1.21 2018/03/06 17:40:04 bouyer Exp $");
 
 #include <sys/param.h>
 #include <sys/bus.h>
@@ -467,7 +467,7 @@
        names = fdtbus_get_string(phandle, prop);
 
        for (name = names, cur = 0; len > 0;
-            name += strlen(name) + 1, cur++) {
+            len -= strlen(name) + 1, name += strlen(name) + 1, cur++) {
                if (index == cur)
                        return name;
        }