diff options
author | Gabriel Marcano <gabemarcano@yahoo.com> | 2023-02-17 16:08:22 -0800 |
---|---|---|
committer | Gabriel Marcano <gabemarcano@yahoo.com> | 2023-02-17 16:08:22 -0800 |
commit | ea77aba560b925bb16a221e0c9a0116f76a2c85c (patch) | |
tree | b92ae203f152e68852b3986eb8ab7df9797e8815 | |
parent | c9e01891e1382afcaee24018c99a18e4db076f10 (diff) | |
download | acpica-ea77aba560b925bb16a221e0c9a0116f76a2c85c.tar.gz |
iasl: check Offset before Subtable dereference
In AcpiDmDumpMadt(), compute and check the Offset before attempting to
dereference Subtable fields to prevent a read overflow.
-rw-r--r-- | source/common/dmtbdump2.c | 10 |
1 files changed, 5 insertions, 5 deletions
diff --git a/source/common/dmtbdump2.c b/source/common/dmtbdump2.c index 353979e8f..e204342cb 100644 --- a/source/common/dmtbdump2.c +++ b/source/common/dmtbdump2.c @@ -1058,16 +1058,16 @@ NextSubtable: Subtable = ACPI_ADD_PTR (ACPI_SUBTABLE_HEADER, Subtable, Subtable->Length); - DbgPrint (ASL_PARSE_OUTPUT, "//[5) Next Subtable %p, length %X]\n", - Subtable, Subtable->Length); - DbgPrint (ASL_PARSE_OUTPUT, "//[5B) Offset from table start: 0x%8.8X%8.8X (%p)]\n", - ACPI_FORMAT_UINT64 (ACPI_CAST_PTR (char, Subtable) - ACPI_CAST_PTR (char, Table)), Subtable); - Offset = ACPI_CAST_PTR (char, Subtable) - ACPI_CAST_PTR (char, Table); if (Offset >= Table->Length) { return; } + + DbgPrint (ASL_PARSE_OUTPUT, "//[5) Next Subtable %p, length %X]\n", + Subtable, Subtable->Length); + DbgPrint (ASL_PARSE_OUTPUT, "//[5B) Offset from table start: 0x%8.8X%8.8X (%p)]\n", + ACPI_FORMAT_UINT64 (ACPI_CAST_PTR (char, Subtable) - ACPI_CAST_PTR (char, Table)), Subtable); } } |