summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorGabriel Marcano <gabemarcano@yahoo.com>2023-02-17 16:08:22 -0800
committerGabriel Marcano <gabemarcano@yahoo.com>2023-02-17 16:08:22 -0800
commitea77aba560b925bb16a221e0c9a0116f76a2c85c (patch)
treeb92ae203f152e68852b3986eb8ab7df9797e8815
parentc9e01891e1382afcaee24018c99a18e4db076f10 (diff)
downloadacpica-ea77aba560b925bb16a221e0c9a0116f76a2c85c.tar.gz
iasl: check Offset before Subtable dereference
In AcpiDmDumpMadt(), compute and check the Offset before attempting to dereference Subtable fields to prevent a read overflow.
-rw-r--r--source/common/dmtbdump2.c10
1 files changed, 5 insertions, 5 deletions
diff --git a/source/common/dmtbdump2.c b/source/common/dmtbdump2.c
index 353979e8f..e204342cb 100644
--- a/source/common/dmtbdump2.c
+++ b/source/common/dmtbdump2.c
@@ -1058,16 +1058,16 @@ NextSubtable:
Subtable = ACPI_ADD_PTR (ACPI_SUBTABLE_HEADER, Subtable,
Subtable->Length);
- DbgPrint (ASL_PARSE_OUTPUT, "//[5) Next Subtable %p, length %X]\n",
- Subtable, Subtable->Length);
- DbgPrint (ASL_PARSE_OUTPUT, "//[5B) Offset from table start: 0x%8.8X%8.8X (%p)]\n",
- ACPI_FORMAT_UINT64 (ACPI_CAST_PTR (char, Subtable) - ACPI_CAST_PTR (char, Table)), Subtable);
-
Offset = ACPI_CAST_PTR (char, Subtable) - ACPI_CAST_PTR (char, Table);
if (Offset >= Table->Length)
{
return;
}
+
+ DbgPrint (ASL_PARSE_OUTPUT, "//[5) Next Subtable %p, length %X]\n",
+ Subtable, Subtable->Length);
+ DbgPrint (ASL_PARSE_OUTPUT, "//[5B) Offset from table start: 0x%8.8X%8.8X (%p)]\n",
+ ACPI_FORMAT_UINT64 (ACPI_CAST_PTR (char, Subtable) - ACPI_CAST_PTR (char, Table)), Subtable);
}
}