sravan/system76-edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ShellPkg: acpiview: Prevent infinite loop if structure length is 0

Browse Source 
REF: https://bugzilla.tianocore.org/show_bug.cgi?id=2534

Extend validation of ACPI structure lengths which are read from the
ACPI table being parsed. Additionally check if the structure 'Length'
field value is positive. If not, stop parsing the faulting table.

Some ACPI tables define internal structures of variable size. The
'Length' field inside the substructure is used to update a pointer used
for table traversal. If the byte-length of the structure is equal to 0,
acpiview can enter an infinite loop. This condition can occur if, for
example, the zero-allocated ACPI table buffer is not fully populated.
This is typically a bug on the ACPI table writer side.

In short, this method helps acpiview recover gracefully from a
zero-valued ACPI structure length.

Signed-off-by: Krzysztof Koch <krzysztof.koch@arm.com>
Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
Reviewed-by: Zhichao Gao <zhichao.gao@intel.com>
This commit is contained in:
Krzysztof Koch
2020-02-19 18:23:38 +08:00
committed by mergify[bot]
parent 70228e101e
commit b85048261a
6 changed files with 47 additions and 52 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Dbg2/Dbg2Parser.c
View File

@ -1,7 +1,7 @@
/** @file /** @file
DBG2 table parser DBG2 table parser
Copyright (c) 2016 - 2019, ARM Limited. All rights reserved. Copyright (c) 2016 - 2020, ARM Limited. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent SPDX-License-Identifier: BSD-2-Clause-Patent
@par Reference(s): @par Reference(s):
@ -282,15 +282,16 @@ ParseAcpiDbg2 (
return; return;
} }
// Make sure the Debug Device Information structure lies inside the table. // Validate Debug Device Information Structure length
if ((Offset + *DbgDevInfoLen) > AcpiTableLength) { if ((*DbgDevInfoLen == 0) ||
((Offset + (*DbgDevInfoLen)) > AcpiTableLength)) {
IncrementErrorCount (); IncrementErrorCount ();
Print ( Print (
L"ERROR: Invalid Debug Device Information structure length. " \ L"ERROR: Invalid Debug Device Information Structure length. " \
L"DbgDevInfoLen = %d. RemainingTableBufferLength = %d. " \ L"Length = %d. Offset = %d. AcpiTableLength = %d.\n",
L"DBG2 parsing aborted.\n",
*DbgDevInfoLen, *DbgDevInfoLen,
AcpiTableLength - Offset Offset,
AcpiTableLength
); );
return; return;
} }

13
ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Gtdt/GtdtParser.c
View File

@ -1,7 +1,7 @@
/** @file /** @file
GTDT table parser GTDT table parser
Copyright (c) 2016 - 2019, ARM Limited. All rights reserved. Copyright (c) 2016 - 2020, ARM Limited. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent SPDX-License-Identifier: BSD-2-Clause-Patent
@par Reference(s): @par Reference(s):
@ -327,15 +327,16 @@ ParseAcpiGtdt (
return; return;
} }
// Make sure the Platform Timer is inside the table. // Validate Platform Timer Structure length
if ((Offset + *PlatformTimerLength) > AcpiTableLength) { if ((*PlatformTimerLength == 0) ||
((Offset + (*PlatformTimerLength)) > AcpiTableLength)) {
IncrementErrorCount (); IncrementErrorCount ();
Print ( Print (
L"ERROR: Invalid Platform Timer Structure length. " \ L"ERROR: Invalid Platform Timer Structure length. " \
L"PlatformTimerLength = %d. RemainingTableBufferLength = %d. " \ L"Length = %d. Offset = %d. AcpiTableLength = %d.\n",
L"GTDT parsing aborted.\n",
*PlatformTimerLength, *PlatformTimerLength,
AcpiTableLength - Offset Offset,
AcpiTableLength
); );
return; return;
} }

14
ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Iort/IortParser.c
View File

@ -1,7 +1,7 @@
/** @file /** @file
IORT table parser IORT table parser
Copyright (c) 2016 - 2019, ARM Limited. All rights reserved. Copyright (c) 2016 - 2020, ARM Limited. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent SPDX-License-Identifier: BSD-2-Clause-Patent
@par Reference(s): @par Reference(s):
@ -687,14 +687,16 @@ ParseAcpiIort (
return; return;
} }
// Make sure the IORT Node is inside the table // Validate IORT Node length
if ((Offset + (*IortNodeLength)) > AcpiTableLength) { if ((*IortNodeLength == 0) ||
((Offset + (*IortNodeLength)) > AcpiTableLength)) {
IncrementErrorCount (); IncrementErrorCount ();
Print ( Print (
L"ERROR: Invalid IORT node length. IortNodeLength = %d. " \ L"ERROR: Invalid IORT Node length. " \
L"RemainingTableBufferLength = %d. IORT parsing aborted.\n", L"Length = %d. Offset = %d. AcpiTableLength = %d.\n",
*IortNodeLength, *IortNodeLength,
AcpiTableLength - Offset Offset,
AcpiTableLength
); );
return; return;
} }

28
ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c
View File

@ -1,7 +1,7 @@
/** @file /** @file
MADT table parser MADT table parser
Copyright (c) 2016 - 2019, ARM Limited. All rights reserved. Copyright (c) 2016 - 2020, ARM Limited. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent SPDX-License-Identifier: BSD-2-Clause-Patent
@par Reference(s): @par Reference(s):
@ -273,28 +273,16 @@ ParseAcpiMadt (
return; return;
} }
// Make sure forward progress is made. // Validate Interrupt Controller Structure length
if (*MadtInterruptControllerLength < 2) { if ((*MadtInterruptControllerLength == 0) ||
((Offset + (*MadtInterruptControllerLength)) > AcpiTableLength)) {
IncrementErrorCount (); IncrementErrorCount ();
Print ( Print (
L"ERROR: Structure length is too small: " \ L"ERROR: Invalid Interrupt Controller Structure length. " \
L"MadtInterruptControllerLength = %d. " \ L"Length = %d. Offset = %d. AcpiTableLength = %d.\n",
L"MadtInterruptControllerType = %d. MADT parsing aborted.\n",
*MadtInterruptControllerLength, *MadtInterruptControllerLength,
*MadtInterruptControllerType Offset,
); AcpiTableLength
return;
}
// Make sure the MADT structure lies inside the table
if ((Offset + *MadtInterruptControllerLength) > AcpiTableLength) {
IncrementErrorCount ();
Print (
L"ERROR: Invalid MADT structure length. " \
L"MadtInterruptControllerLength = %d. " \
L"RemainingTableBufferLength = %d. MADT parsing aborted.\n",
*MadtInterruptControllerLength,
AcpiTableLength - Offset
); );
return; return;
} }

15
ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Pptt/PpttParser.c
View File

@ -1,7 +1,7 @@
/** @file /** @file
PPTT table parser PPTT table parser
Copyright (c) 2019, ARM Limited. All rights reserved. Copyright (c) 2019 - 2020, ARM Limited. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent SPDX-License-Identifier: BSD-2-Clause-Patent
@par Reference(s): @par Reference(s):
@ -425,15 +425,16 @@ ParseAcpiPptt (
return; return;
} }
// Make sure the PPTT structure lies inside the table // Validate Processor Topology Structure length
if ((Offset + *ProcessorTopologyStructureLength) > AcpiTableLength) { if ((*ProcessorTopologyStructureLength == 0) ||
((Offset + (*ProcessorTopologyStructureLength)) > AcpiTableLength)) {
IncrementErrorCount (); IncrementErrorCount ();
Print ( Print (
L"ERROR: Invalid PPTT structure length. " \ L"ERROR: Invalid Processor Topology Structure length. " \
L"ProcessorTopologyStructureLength = %d. " \ L"Length = %d. Offset = %d. AcpiTableLength = %d.\n",
L"RemainingTableBufferLength = %d. PPTT parsing aborted.\n",
*ProcessorTopologyStructureLength, *ProcessorTopologyStructureLength,
AcpiTableLength - Offset Offset,
AcpiTableLength
); );
return; return;
} }

14
ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Srat/SratParser.c
View File

@ -1,7 +1,7 @@
/** @file /** @file
SRAT table parser SRAT table parser
Copyright (c) 2016 - 2019, ARM Limited. All rights reserved. Copyright (c) 2016 - 2020, ARM Limited. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent SPDX-License-Identifier: BSD-2-Clause-Patent
@par Reference(s): @par Reference(s):
@ -412,14 +412,16 @@ ParseAcpiSrat (
return; return;
} }
// Make sure the SRAT structure lies inside the table // Validate Static Resource Allocation Structure length
if ((Offset + *SratRALength) > AcpiTableLength) { if ((*SratRALength == 0) ||
((Offset + (*SratRALength)) > AcpiTableLength)) {
IncrementErrorCount (); IncrementErrorCount ();
Print ( Print (
L"ERROR: Invalid SRAT structure length. SratRALength = %d. " \ L"ERROR: Invalid Static Resource Allocation Structure length. " \
L"RemainingTableBufferLength = %d. SRAT parsing aborted.\n", L"Length = %d. Offset = %d. AcpiTableLength = %d.\n",
*SratRALength, *SratRALength,
AcpiTableLength - Offset Offset,
AcpiTableLength
); );
return; return;
} }