efi: Fix out-of-bounds read in variable_matches()

The variable_matches() function can currently read "var_name[len]", for
example when:

 - var_name[0] == 'a',
 - len == 1
 - match_name points to the NUL-terminated string "ab".

This function is supposed to accept "var_name" inputs that are not
NUL-terminated (hence the "len" parameter"). Document the function, and
access "var_name[*match]" only if "*match" is smaller than "len".

Reported-by: Chris Wilson <[email protected]>
Signed-off-by: Laszlo Ersek <[email protected]>
Cc: Peter Jones <[email protected]>
Cc: Matthew Garrett <[email protected]>
Cc: Jason Andryuk <[email protected]>
Cc: Jani Nikula <[email protected]>
Cc: <[email protected]> # v3.10+
Link: http://thread.gmane.org/gmane.comp.freedesktop.xorg.drivers.intel/86906
Signed-off-by: Matt Fleming <[email protected]>

0 files changed, 0 insertions, 0 deletions