tyler.durden
/
audk
mirror of https://github.com/acidanthera/audk.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

ShellPkg: acpiview: MADT: Split structure length validation 

Split the Interrupt Controller Structure length validation in the
acpiview UEFI shell tool into two logical parts:
1. Ensuring MADT table parser forward progress.
2. Preventing MADT table buffer overruns.

Also, make the condition for infinite loop detection applicable to
all types of Interrupt Controller Structures (for all interrupt models
which can be represented in MADT). Check if the controller length
specified is shorter than the byte size of the first two fields
('Type' and 'Length') present in every valid Interrupt Controller
Structure.

Signed-off-by: Krzysztof Koch <krzysztof.koch@arm.com>
Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>
Reviewed-by: Zhichao Gao <zhichao.gao@intel.com>
This commit is contained in:
Krzysztof Koch 2019-07-22 15:50:25 -07:00 committed by Jaben Carsey
parent 748c1efd1e
commit d23bf79734
1 changed files with 22 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c
View File

@ -260,16 +260,30 @@ ParseAcpiMadt (
PARSER_PARAMS (MadtInterruptControllerHeaderParser) PARSER_PARAMS (MadtInterruptControllerHeaderParser)
); );
if (((Offset + (*MadtInterruptControllerLength)) > AcpiTableLength) || // Make sure forward progress is made.
(*MadtInterruptControllerLength < 4)) { if (*MadtInterruptControllerLength < 2) {
IncrementErrorCount (); IncrementErrorCount ();
Print ( Print (
L"ERROR: Invalid Interrupt Controller Length," L"ERROR: Structure length is too small: " \
L" Type = %d, Length = %d\n", L"MadtInterruptControllerLength = %d. " \
*MadtInterruptControllerType, L"MadtInterruptControllerType = %d. MADT parsing aborted.\n",
*MadtInterruptControllerLength *MadtInterruptControllerLength,
*MadtInterruptControllerType
); );
break; return;
}
// Make sure the MADT structure lies inside the table
if ((Offset + *MadtInterruptControllerLength) > AcpiTableLength) {
IncrementErrorCount ();
Print (
L"ERROR: Invalid MADT structure length. " \
L"MadtInterruptControllerLength = %d. " \
L"RemainingTableBufferLength = %d. MADT parsing aborted.\n",
*MadtInterruptControllerLength,
AcpiTableLength - Offset
);
return;
} }
switch (*MadtInterruptControllerType) { switch (*MadtInterruptControllerType) {