|
Zbigniew Jędrzejewski-Szmek |
930e1b |
From 98f6a4dfe1d6e601ddd2b59c42e8fc16193d187b Mon Sep 17 00:00:00 2001
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
From: Pavel Holica <conscript89@gmail.com>
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
Date: Wed, 6 Nov 2013 23:24:16 +0100
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
Subject: [PATCH] acpi-fpdt: break on zero or negative length read
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
https://bugzilla.redhat.com/show_bug.cgi?id=1027478
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
---
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
src/shared/acpi-fpdt.c | 2 ++
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
1 file changed, 2 insertions(+)
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
diff --git a/src/shared/acpi-fpdt.c b/src/shared/acpi-fpdt.c
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
index 75648b4..7bae47f 100644
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
--- a/src/shared/acpi-fpdt.c
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
+++ b/src/shared/acpi-fpdt.c
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
@@ -109,6 +109,8 @@ int acpi_get_boot_usec(usec_t *loader_start, usec_t *loader_exit) {
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
for (rec = (struct acpi_fpdt_header *)(buf + sizeof(struct acpi_table_header));
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
(char *)rec < buf + l;
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
rec = (struct acpi_fpdt_header *)((char *)rec + rec->length)) {
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
+ if (rec->length <= 0)
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
+ break;
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
if (rec->type != ACPI_FPDT_TYPE_BOOT)
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
continue;
|
|
Zbigniew Jędrzejewski-Szmek |
930e1b |
if (rec->length != sizeof(struct acpi_fpdt_header))
|