From ec37fd9c1fbc6c14ad3291b415ad6677a022a554 Mon Sep 17 00:00:00 2001 From: Pierre Gondois Date: Thu, 9 Dec 2021 10:25:05 +0100 Subject: [PATCH] DynamicTablesPkg: Fix multiple objects parsing When a CmObjDesc contains multiple objects, only the first one is parsed as the buffer doesn't progress. Fix this. Also check that the whole buffer has been parsed with an asset. Signed-off-by: Pierre Gondois Reviewed-by: Sami Mujawar --- .../ConfigurationManagerObjectParser.c | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/DynamicTablesPkg/Library/Common/TableHelperLib/ConfigurationManagerObjectParser.c b/DynamicTablesPkg/Library/Common/TableHelperLib/ConfigurationManagerObjectParser.c index 84a35e8314..c1b21d24a4 100644 --- a/DynamicTablesPkg/Library/Common/TableHelperLib/ConfigurationManagerObjectParser.c +++ b/DynamicTablesPkg/Library/Common/TableHelperLib/ConfigurationManagerObjectParser.c @@ -688,6 +688,7 @@ ParseCmObjDesc ( UINT32 ObjIndex; UINT32 ObjectCount; INTN RemainingSize; + INTN Offset; CONST CM_OBJ_PARSER_ARRAY *ParserArray; if ((CmObjDesc == NULL) || (CmObjDesc->Data == NULL)) { @@ -722,6 +723,7 @@ ParseCmObjDesc ( ObjectCount = CmObjDesc->Count; RemainingSize = CmObjDesc->Size; + Offset = 0; for (ObjIndex = 0; ObjIndex < ObjectCount; ObjIndex++) { DEBUG (( @@ -733,11 +735,21 @@ ParseCmObjDesc ( ObjectCount )); PrintCmObjDesc ( - CmObjDesc->Data, + (VOID *)((UINTN)CmObjDesc->Data + Offset), ParserArray->Parser, ParserArray->ItemCount, &RemainingSize, 1 ); + if ((RemainingSize > CmObjDesc->Size) || + (RemainingSize < 0)) + { + ASSERT (0); + return; + } + + Offset = CmObjDesc->Size - RemainingSize; } // for + + ASSERT (RemainingSize == 0); }