From f4cbcf6081b27dd2fff04c68717cd5ac7a214df7 Mon Sep 17 00:00:00 2001
From: "H. Peter Anvin" <hpa@zytor.com>
Date: Mon, 16 Feb 2009 21:02:23 -0800
Subject: [PATCH] pxelinux: Minimum size for PXENV+ is 0x28 bytes

The minimum size for the PXENV+ structure is 0x28 bytes (for PXE
1.x/2.0); the size will be 0x2C if the !PXE pointer is provided.
---
 core/pxelinux.asm | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/core/pxelinux.asm b/core/pxelinux.asm
index 4dfa7af..e23c3dd 100644
--- a/core/pxelinux.asm
+++ b/core/pxelinux.asm
@@ -392,6 +392,8 @@ have_pxenv:
 
 		cmp ax,0201h			; API version 2.1 or higher
 		jb old_api
+		cmp byte [es:bx+8],2Ch		; Space for !PXE pointer?
+		jb old_api
 		mov si,bx
 		mov ax,es
 		les bx,[es:bx+28h]		; !PXE structure pointer
@@ -1020,6 +1022,7 @@ is_struc:
 		cmp word [es:bx+4],'V+'
 		jne .bad
 		movzx cx,[es:bx+8]
+		cmp cx,28h
 		jb .bad
 .checksum:
 		mov si,bx
-- 
2.7.4