Split the Interrupt Controller Structure length validation in the
acpiview UEFI shell tool into two logical parts:
1. Ensuring MADT table parser forward progress.
2. Preventing MADT table buffer overruns.
Also, make the condition for infinite loop detection applicable to
all types of Interrupt Controller Structures (for all interrupt models
which can be represented in MADT). Check if the controller length
specified is shorter than the byte size of the first two fields
('Type' and 'Length') present in every valid Interrupt Controller
Structure.
Signed-off-by: Krzysztof Koch <krzysztof.koch@arm.com>
---
Notes:
v1:
- split MADT structure length validation [Krzysztof]
ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c | 30 ++++++++++++++------
1 file changed, 22 insertions(+), 8 deletions(-)
diff --git a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c
index 59c3df0cc8a080497b517baf36fc63f1e4ab866f..52b71f37a40733de2029373306658ca08c78c42d 100644
--- a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c
+++ b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c
@@ -290,16 +290,30 @@ ParseAcpiMadt (
PARSER_PARAMS (MadtInterruptControllerHeaderParser)
);
- if (((Offset + (*MadtInterruptControllerLength)) > AcpiTableLength) ||
- (*MadtInterruptControllerLength < 4)) {
+ // Make sure forward progress is made.
+ if (*MadtInterruptControllerLength < 2) {
IncrementErrorCount ();
Print (
- L"ERROR: Invalid Interrupt Controller Length,"
- L" Type = %d, Length = %d\n",
- *MadtInterruptControllerType,
- *MadtInterruptControllerLength
- );
- break;
+ L"ERROR: Structure length is too small: " \
+ L"MadtInterruptControllerLength = %d. " \
+ L"MadtInterruptControllerType = %d. MADT parsing aborted.\n",
+ *MadtInterruptControllerLength,
+ *MadtInterruptControllerType
+ );
+ return;
+ }
+
+ // Make sure the MADT structure lies inside the table
+ if ((Offset + *MadtInterruptControllerLength) > AcpiTableLength) {
+ IncrementErrorCount ();
+ Print (
+ L"ERROR: Invalid MADT structure length. " \
+ L"MadtInterruptControllerLength = %d. " \
+ L"RemainingTableBufferLength = %d. MADT parsing aborted.\n",
+ *MadtInterruptControllerLength,
+ AcpiTableLength - Offset
+ );
+ return;
}
switch (*MadtInterruptControllerType) {
--
'Guid(CE165669-3EF3-493F-B85D-6190EE5B9759)'
-=-=-=-=-=-=-=-=-=-=-=-
Groups.io Links: You receive all messages sent to this group.
View/Reply Online (#43939): https://edk2.groups.io/g/devel/message/43939
Mute This Topic: https://groups.io/mt/32514386/1787277
Group Owner: devel+owner@edk2.groups.io
Unsubscribe: https://edk2.groups.io/g/devel/unsub [importer@patchew.org]
-=-=-=-=-=-=-=-=-=-=-=-