daandemeyer / rpms / systemd

Forked from rpms/systemd 2 years ago
Clone
9fc0f6
From 113e2da2789ac680d2042993dcf76eef43072f4d Mon Sep 17 00:00:00 2001
9fc0f6
From: Pavel Holica <conscript89@gmail.com>
9fc0f6
Date: Wed, 6 Nov 2013 23:24:16 +0100
9fc0f6
Subject: [PATCH] acpi-fpdt: break on zero or negative length read
9fc0f6
9fc0f6
https://bugzilla.redhat.com/show_bug.cgi?id=1027478
9fc0f6
---
9fc0f6
 src/shared/acpi-fpdt.c | 2 ++
9fc0f6
 1 file changed, 2 insertions(+)
9fc0f6
9fc0f6
diff --git a/src/shared/acpi-fpdt.c b/src/shared/acpi-fpdt.c
9fc0f6
index 75648b4..7bae47f 100644
9fc0f6
--- a/src/shared/acpi-fpdt.c
9fc0f6
+++ b/src/shared/acpi-fpdt.c
9fc0f6
@@ -109,6 +109,8 @@ int acpi_get_boot_usec(usec_t *loader_start, usec_t *loader_exit) {
9fc0f6
         for (rec = (struct acpi_fpdt_header *)(buf + sizeof(struct acpi_table_header));
9fc0f6
              (char *)rec < buf + l;
9fc0f6
              rec = (struct acpi_fpdt_header *)((char *)rec + rec->length)) {
9fc0f6
+                if (rec->length <= 0)
9fc0f6
+                        break;
9fc0f6
                 if (rec->type != ACPI_FPDT_TYPE_BOOT)
9fc0f6
                         continue;
9fc0f6
                 if (rec->length != sizeof(struct acpi_fpdt_header))