From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=pass header.i=@armh.onmicrosoft.com header.s=selector2-armh-onmicrosoft-com header.b=YaFCbCcZ; spf=pass (domain: arm.com, ip: 40.107.7.48, mailfrom: krzysztof.koch@arm.com) Received: from EUR04-HE1-obe.outbound.protection.outlook.com (EUR04-HE1-obe.outbound.protection.outlook.com [40.107.7.48]) by groups.io with SMTP; Thu, 11 Jul 2019 23:54:59 -0700 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=armh.onmicrosoft.com; s=selector2-armh-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=e3PXlcSzQGJuxhwR4llQqCmZ2NCSEBOWTzq4jBwtw30=; b=YaFCbCcZrf3cerzyYheeL3zG0PsnitjbzOuBG8i4j6q1/4qitSc2jzb1YQYQx3Xdg1ojTqaZkbJEqouCf7MUBZylIikremyaiLkg/gglmn/3x/G8dOlUTvSvA6eY/C91gM0kmLxgCE9P0zCpp8ix/cOZnKUCq/ZdwZAf+M0Padc= Received: from VI1PR08CA0178.eurprd08.prod.outlook.com (2603:10a6:800:d1::32) by AM0PR08MB4947.eurprd08.prod.outlook.com (2603:10a6:208:158::20) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.20.2052.17; Fri, 12 Jul 2019 06:54:54 +0000 Received: from DB5EUR03FT010.eop-EUR03.prod.protection.outlook.com (2a01:111:f400:7e0a::207) by VI1PR08CA0178.outlook.office365.com (2603:10a6:800:d1::32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384) id 15.20.2073.11 via Frontend Transport; Fri, 12 Jul 2019 06:54:54 +0000 Authentication-Results: spf=temperror (sender IP is 40.67.248.234) smtp.mailfrom=arm.com; edk2.groups.io; dkim=none (message not signed) header.d=none;edk2.groups.io; dmarc=temperror action=none header.from=arm.com; Received-SPF: TempError (protection.outlook.com: error in processing during lookup of arm.com: DNS Timeout) Received: from nebula.arm.com (40.67.248.234) by DB5EUR03FT010.mail.protection.outlook.com (10.152.20.96) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.20.2052.18 via Frontend Transport; Fri, 12 Jul 2019 06:54:52 +0000 Received: from AZ-NEU-EX01.Emea.Arm.com (10.251.26.4) by AZ-NEU-EX04.Arm.com (10.251.24.32) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256) id 15.1.1415.2; Fri, 12 Jul 2019 06:53:22 +0000 Received: from AZ-NEU-EX03.Arm.com (10.251.24.31) by AZ-NEU-EX01.Emea.Arm.com (10.251.26.4) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256_P256) id 15.1.1415.2; Fri, 12 Jul 2019 06:53:22 +0000 Received: from E119924.Arm.com (10.37.8.167) by mail.arm.com (10.251.24.31) with Microsoft SMTP Server id 15.1.1415.2 via Frontend Transport; Fri, 12 Jul 2019 06:53:21 +0000 From: "Krzysztof Koch" To: CC: , , , , , Subject: [PATCH v1 09/11] ShellPkg: acpiview: IORT: Add error-checking in the parsing logic Date: Fri, 12 Jul 2019 07:52:41 +0100 Message-ID: <20190712065243.3812-10-krzysztof.koch@arm.com> X-Mailer: git-send-email 2.16.2.windows.1 In-Reply-To: <20190712065243.3812-1-krzysztof.koch@arm.com> References: <20190712065243.3812-1-krzysztof.koch@arm.com> Return-Path: Krzysztof.Koch@arm.com MIME-Version: 1.0 X-EOPAttributedMessage: 0 X-MS-Office365-Filtering-HT: Tenant X-Forefront-Antispam-Report: CIP:40.67.248.234;IPV:NLI;CTRY:IE;EFV:NLI;SFV:NSPM;SFS:(10009020)(4636009)(39860400002)(376002)(346002)(136003)(396003)(2980300002)(199004)(189003)(478600001)(6916009)(8676002)(36756003)(1076003)(336012)(70586007)(19627235002)(2351001)(26005)(53936002)(8936002)(16586007)(316002)(81166006)(6306002)(966005)(5660300002)(86362001)(70206006)(186003)(81156014)(7696005)(30864003)(53416004)(2906002)(486006)(48376002)(76176011)(4326008)(305945005)(2616005)(47776003)(126002)(446003)(63370400001)(50226002)(63350400001)(476003)(11346002)(44832011)(50466002)(54906003)(426003)(356004)(6666004)(68736007)(51416003);DIR:OUT;SFP:1101;SCL:1;SRVR:AM0PR08MB4947;H:nebula.arm.com;FPR:;SPF:TempError;LANG:en;PTR:InfoDomainNonexistent;A:1;MX:1; X-MS-PublicTrafficType: Email X-MS-Office365-Filtering-Correlation-Id: d4eeaf44-afa4-463d-3444-08d70695d75f X-Microsoft-Antispam: BCL:0;PCL:0;RULEID:(2390118)(7020095)(4652040)(8989299)(4534185)(4627221)(201703031133081)(201702281549075)(8990200)(5600148)(711020)(4605104)(1401327)(2017052603328);SRVR:AM0PR08MB4947; X-MS-TrafficTypeDiagnostic: AM0PR08MB4947: X-MS-Exchange-PUrlCount: 1 X-Microsoft-Antispam-PRVS: NoDisclaimer: True X-MS-Oob-TLC-OOBClassifiers: OLM:7219; X-Forefront-PRVS: 00963989E5 X-MS-Exchange-SenderADCheck: 1 X-Microsoft-Antispam-Message-Info: tEwwAdAuTTBs1+F7AuFzqlUZQqh5shBKsFq+Ui3XrdeE53l+McZ1dmQNSyosUMTP5U7LmfEshXGksz2/Ny/i8fL6qLlVJ7kTmHx3D3pgn7P8ECxdptU5FLoFvCOp0LneMHmPjUqpAEyeZfW/VCeMZv9nSvCUHceszBw2H42QVx0l7Tm0Dvi/tJCrQG4X+0iVUz8l8hNcO8lNuX4PUe3i2tqy1ASyb6MSg7ADTSnJn3iqshNOgfx0EtxtqCjN17eNAGbGATARoREEaHrYo7hp0WAQWoQrXb9VhNSm+JtIdcN0X5fghn5jinmft4FF/KmvsqxN34HfsnfQXOr5Z1qEHnVPkdRg4/r7r7nykJX4pLIKns6UQEGbXo9zssVkUW8kop7ebmSBeY43kQ25BG07nboRT4H35rSqRolCsL9E+SM= X-OriginatorOrg: arm.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 12 Jul 2019 06:54:52.9328 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: d4eeaf44-afa4-463d-3444-08d70695d75f X-MS-Exchange-CrossTenant-Id: f34e5979-57d9-4aaa-ad4d-b122a662184d X-MS-Exchange-CrossTenant-OriginalAttributedTenantConnectingIp: TenantId=f34e5979-57d9-4aaa-ad4d-b122a662184d;Ip=[40.67.248.234];Helo=[nebula.arm.com] X-MS-Exchange-CrossTenant-FromEntityHeader: HybridOnPrem X-MS-Exchange-Transport-CrossTenantHeadersStamped: AM0PR08MB4947 Content-Type: text/plain 1. Check if the global pointers (in the scope of this ACPI table parser) have been successfully updated before they are later used to control the parsing logic. 2. Remove redundant forward function declarations by repositioning blocks of code. 3. Test against buffer overruns. 4. Allow silencing ACPI table content validation errors which do not cause table parsing to fail. 5. Move ID mapping count validation for the PMCG node to the IortNodePmcgParser[] ACPI_PARSER array. This check does not affect the flow of IORT parsing and is limited to a single table field in scope. Signed-off-by: Krzysztof Koch --- Changes can be seen at: https://github.com/KrzysztofKoch1/edk2/commit/0b398f116f7aed99dbec4090b5c2c0ed93273ef7 Notes: v1: - improve the logic in the IORT parser [Krzysztof] ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Iort/IortParser.c | 419 +++++++++++++------- 1 file changed, 279 insertions(+), 140 deletions(-) diff --git a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Iort/IortParser.c b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Iort/IortParser.c index 93f78e1a9786ed53f6b5529f478b72a220b4f8df..f09e7aeeb34bf4c3d9564240b53539c8d6811f66 100644 --- a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Iort/IortParser.c +++ b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Iort/IortParser.c @@ -13,6 +13,7 @@ #include #include "AcpiParser.h" #include "AcpiTableParser.h" +#include "AcpiView.h" // Local variables STATIC ACPI_DESCRIPTION_HEADER_INFO AcpiHdrInfo; @@ -45,7 +46,35 @@ EFIAPI ValidateItsIdMappingCount ( IN UINT8* Ptr, IN VOID* Context - ); + ) +{ + if (*(UINT32*)Ptr != 0) { + IncrementErrorCount (); + Print (L"\nERROR: IORT ID Mapping count must be zero."); + } +} + +/** + This function validates the ID Mapping array count for the Performance + Monitoring Counter Group (PMCG) node. + + @param [in] Ptr Pointer to the start of the field data. + @param [in] Context Pointer to context specific information e.g. this + could be a pointer to the ACPI table header. +**/ +STATIC +VOID +EFIAPI +ValidatePmcgIdMappingCount ( + IN UINT8* Ptr, + IN VOID* Context + ) +{ + if (*(UINT32*)Ptr > 1) { + IncrementErrorCount (); + Print (L"\nERROR: IORT ID Mapping count must not be greater than 1."); + } +} /** This function validates the ID Mapping array offset for the ITS node. @@ -60,7 +89,13 @@ EFIAPI ValidateItsIdArrayReference ( IN UINT8* Ptr, IN VOID* Context - ); + ) +{ + if (*(UINT32*)Ptr != 0) { + IncrementErrorCount (); + Print (L"\nERROR: IORT ID Mapping offset must be zero."); + } +} /** Helper Macro for populating the IORT Node header in the ACPI_PARSER array. @@ -204,95 +239,65 @@ STATIC CONST ACPI_PARSER IortNodeRootComplexParser[] = { An ACPI_PARSER array describing the IORT PMCG node. **/ STATIC CONST ACPI_PARSER IortNodePmcgParser[] = { - PARSE_IORT_NODE_HEADER (NULL, NULL), + PARSE_IORT_NODE_HEADER (ValidatePmcgIdMappingCount, NULL), {L"Base Address", 8, 16, L"0x%lx", NULL, NULL, NULL, NULL}, {L"Overflow interrupt GSIV", 4, 24, L"0x%x", NULL, NULL, NULL, NULL}, {L"Node reference", 4, 28, L"0x%x", NULL, NULL, NULL, NULL}, }; -/** - This function validates the ID Mapping array count for the ITS node. - - @param [in] Ptr Pointer to the start of the field data. - @param [in] Context Pointer to context specific information e.g. this - could be a pointer to the ACPI table header. -**/ -STATIC -VOID -EFIAPI -ValidateItsIdMappingCount ( - IN UINT8* Ptr, - IN VOID* Context - ) -{ - if (*(UINT32*)Ptr != 0) { - IncrementErrorCount (); - Print (L"\nERROR: IORT ID Mapping count must be zero."); - } -} - -/** - This function validates the ID Mapping array offset for the ITS node. - - @param [in] Ptr Pointer to the start of the field data. - @param [in] Context Pointer to context specific information e.g. this - could be a pointer to the ACPI table header. -**/ -STATIC -VOID -EFIAPI -ValidateItsIdArrayReference ( - IN UINT8* Ptr, - IN VOID* Context - ) -{ - if (*(UINT32*)Ptr != 0) { - IncrementErrorCount (); - Print (L"\nERROR: IORT ID Mapping offset must be zero."); - } -} - /** This function parses the IORT Node Id Mapping array. - @param [in] Ptr Pointer to the start of the IORT Table. + @param [in] Ptr Pointer to the start of the ID mapping array. + @param [in] Length Length of the buffer. @param [in] MappingCount The ID Mapping count. - @param [in] MappingOffset The offset of the ID Mapping array - from the start of the IORT table. **/ STATIC VOID DumpIortNodeIdMappings ( IN UINT8* Ptr, - IN UINT32 MappingCount, - IN UINT32 MappingOffset + IN UINT32 Length, + IN UINT32 MappingCount ) { - UINT8* IdMappingPtr; UINT32 Index; UINT32 Offset; CHAR8 Buffer[40]; // Used for AsciiName param of ParseAcpi - IdMappingPtr = Ptr + MappingOffset; Index = 0; - while (Index < MappingCount) { + Offset = 0; + + while ((Index < MappingCount) && + (Offset < Length)) { AsciiSPrint ( Buffer, sizeof (Buffer), "ID Mapping [%d]", Index ); - Offset = ParseAcpi ( - TRUE, - 4, - Buffer, - IdMappingPtr, - 20, - PARSER_PARAMS (IortNodeIdMappingParser) - ); - IdMappingPtr += Offset; + Offset += ParseAcpi ( + TRUE, + 4, + Buffer, + Ptr + Offset, + Length - Offset, + PARSER_PARAMS (IortNodeIdMappingParser) + ); Index++; } + + // Cross-check the substructure count with the length of the encapsulating + // buffer + if (GetConsistencyChecking () && + (Index < MappingCount)) { + IncrementErrorCount (); + Print ( + L"ERROR: Invalid ID Mapping Count. IdMappingCount = %d. " \ + L"IdMappingBufferSize = %d.\n", + MappingCount, + Length + ); + } } /** @@ -317,8 +322,6 @@ DumpIortNodeSmmuV1V2 ( UINT32 Offset; CHAR8 Buffer[50]; // Used for AsciiName param of ParseAcpi - UINT8* ArrayPtr; - ParseAcpi ( TRUE, 2, @@ -328,51 +331,97 @@ DumpIortNodeSmmuV1V2 ( PARSER_PARAMS (IortNodeSmmuV1V2Parser) ); - ArrayPtr = Ptr + *InterruptContextOffset; + // Check if the values used to control the parsing logic have been + // successfully read. + if ((InterruptContextCount == NULL) || + (InterruptContextOffset == NULL) || + (PmuInterruptCount == NULL) || + (PmuInterruptOffset == NULL)) { + IncrementErrorCount (); + Print ( + L"ERROR: Insufficient SMMUv1/2 node length. Length = %d\n", + Length + ); + return; + } + + Offset = *InterruptContextOffset; Index = 0; - while (Index < *InterruptContextCount) { + + while ((Index < *InterruptContextCount) && + (Offset < Length)) { AsciiSPrint ( Buffer, sizeof (Buffer), "Context Interrupts Array [%d]", Index ); - Offset = ParseAcpi ( - TRUE, - 4, - Buffer, - ArrayPtr, - 8, - PARSER_PARAMS (InterruptArrayParser) - ); - ArrayPtr += Offset; + Offset += ParseAcpi ( + TRUE, + 4, + Buffer, + Ptr + Offset, + Length - Offset, + PARSER_PARAMS (InterruptArrayParser) + ); Index++; } - ArrayPtr = Ptr + *PmuInterruptOffset; + // Cross-check the substructure count with the length of the encapsulating + // buffer + if (GetConsistencyChecking () && + (Index < *InterruptContextCount)) { + IncrementErrorCount (); + Print ( + L"ERROR: Invalid Context Interrupt count. InterruptContextCount = %d. " \ + L"SMMUv1v2BufferSize = %d.\n", + *InterruptContextCount, + Length + ); + return; + } + + Offset = *PmuInterruptOffset; Index = 0; - while (Index < *PmuInterruptCount) { + + while ((Index < *PmuInterruptCount) && + (Offset < Length)) { AsciiSPrint ( Buffer, sizeof (Buffer), "PMU Interrupts Array [%d]", Index ); - Offset = ParseAcpi ( - TRUE, - 4, - Buffer, - ArrayPtr, - 8, - PARSER_PARAMS (InterruptArrayParser) - ); - ArrayPtr += Offset; + Offset += ParseAcpi ( + TRUE, + 4, + Buffer, + Ptr + Offset, + Length - Offset, + PARSER_PARAMS (InterruptArrayParser) + ); Index++; } - if (*IortIdMappingCount != 0) { - DumpIortNodeIdMappings (Ptr, MappingCount, MappingOffset); + // Cross-check the substructure count with the length of the encapsulating + // buffer + if (GetConsistencyChecking () && + (Index < *PmuInterruptCount)) { + IncrementErrorCount (); + Print ( + L"ERROR: Invalid PMU Interrupt count. PmuInterruptCount = %d. " \ + L"SMMUv1v2BufferSize = %d.\n", + *PmuInterruptCount, + Length + ); + return; } + + DumpIortNodeIdMappings ( + Ptr + MappingOffset, + Length - MappingOffset, + MappingCount + ); } /** @@ -402,9 +451,11 @@ DumpIortNodeSmmuV3 ( PARSER_PARAMS (IortNodeSmmuV3Parser) ); - if (*IortIdMappingCount != 0) { - DumpIortNodeIdMappings (Ptr, MappingCount, MappingOffset); - } + DumpIortNodeIdMappings ( + Ptr + MappingOffset, + Length - MappingOffset, + MappingCount + ); } /** @@ -422,40 +473,64 @@ DumpIortNodeIts ( { UINT32 Offset; UINT32 Index; - UINT8* ItsIdPtr; CHAR8 Buffer[80]; // Used for AsciiName param of ParseAcpi Offset = ParseAcpi ( - TRUE, - 2, - "ITS Node", - Ptr, - Length, - PARSER_PARAMS (IortNodeItsParser) - ); + TRUE, + 2, + "ITS Node", + Ptr, + Length, + PARSER_PARAMS (IortNodeItsParser) + ); + + // Check if the values used to control the parsing logic have been + // successfully read. + if (ItsCount == NULL) { + IncrementErrorCount (); + Print ( + L"ERROR: Insufficient ITS group length. Length = %d.\n", + Length + ); + return; + } - ItsIdPtr = Ptr + Offset; Index = 0; - while (Index < *ItsCount) { + + while ((Index < *ItsCount) && + (Offset < Length)) { AsciiSPrint ( Buffer, sizeof (Buffer), "GIC ITS Identifier Array [%d]", Index ); - Offset = ParseAcpi ( - TRUE, - 4, - Buffer, - ItsIdPtr, - 4, - PARSER_PARAMS (ItsIdParser) - ); - ItsIdPtr += Offset; + Offset += ParseAcpi ( + TRUE, + 4, + Buffer, + Ptr + Offset, + Length - Offset, + PARSER_PARAMS (ItsIdParser) + ); Index++; } + // Cross-check the substructure count with the length of the encapsulating + // buffer + if (GetConsistencyChecking () && + (Index < *ItsCount)) { + IncrementErrorCount (); + Print ( + L"ERROR: Invalid GIC ITS identifier count. ItsCount = %d. " \ + L"ItsGroupBufferSize = %d.\n", + *ItsCount, + Length + ); + } + // Note: ITS does not have the ID Mappings Array + } /** @@ -478,8 +553,6 @@ DumpIortNodeNamedComponent ( { UINT32 Offset; UINT32 Index; - UINT8* DeviceNamePtr; - UINT32 DeviceNameLength; Offset = ParseAcpi ( TRUE, @@ -490,19 +563,35 @@ DumpIortNodeNamedComponent ( PARSER_PARAMS (IortNodeNamedComponentParser) ); - DeviceNamePtr = Ptr + Offset; // Estimate the Device Name length - DeviceNameLength = Length - Offset - (MappingCount * 20); PrintFieldName (2, L"Device Object Name"); Index = 0; - while ((Index < DeviceNameLength) && (DeviceNamePtr[Index] != 0)) { - Print (L"%c", DeviceNamePtr[Index++]); + + while ((*(Ptr + Offset) != 0) && + (Offset < Length)) { + Print (L"%c", *(Ptr + Offset)); + Offset++; } Print (L"\n"); - if (*IortIdMappingCount != 0) { - DumpIortNodeIdMappings (Ptr, MappingCount, MappingOffset); + // Cross-check the string length with the size of the encapsulating + // buffer + if (GetConsistencyChecking () && + (*(Ptr + Offset) != '\0')) { + IncrementErrorCount (); + Print ( + L"ERROR: Invalid Device object name string. " \ + L"NamedComponentBufferSize = %d.\n", + Length + ); + return; } + + DumpIortNodeIdMappings ( + Ptr + MappingOffset, + Length - MappingOffset, + MappingCount + ); } /** @@ -532,9 +621,11 @@ DumpIortNodeRootComplex ( PARSER_PARAMS (IortNodeRootComplexParser) ); - if (*IortIdMappingCount != 0) { - DumpIortNodeIdMappings (Ptr, MappingCount, MappingOffset); - } + DumpIortNodeIdMappings ( + Ptr + MappingOffset, + Length - MappingOffset, + MappingCount + ); } /** @@ -562,19 +653,13 @@ DumpIortNodePmcg ( Ptr, Length, PARSER_PARAMS (IortNodePmcgParser) - ); + ); - if (*IortIdMappingCount != 0) { - DumpIortNodeIdMappings (Ptr, MappingCount, MappingOffset); - } - - if (*IortIdMappingCount > 1) { - IncrementErrorCount (); - Print ( - L"ERROR: ID mapping must not be greater than 1. Id Mapping Count =%d\n", - *IortIdMappingCount - ); - } + DumpIortNodeIdMappings ( + Ptr + MappingOffset, + Length - MappingOffset, + MappingCount + ); } /** @@ -621,23 +706,61 @@ ParseAcpiIort ( AcpiTableLength, PARSER_PARAMS (IortParser) ); + + // Check if the values used to control the parsing logic have been + // successfully read. + if ((IortNodeCount == NULL) || + (IortNodeOffset == NULL)) { + IncrementErrorCount (); + Print ( + L"ERROR: Insufficient table length. AcpiTableLength = %d.\n", + AcpiTableLength + ); + return; + } + Offset = *IortNodeOffset; NodePtr = Ptr + Offset; Index = 0; - while ((Index < *IortNodeCount) && (Offset < AcpiTableLength)) { + // Parse the specified number of IORT nodes or the IORT table buffer length. + // Whichever is minimum. + while ((Index++ < *IortNodeCount) && + (Offset < AcpiTableLength)) { // Parse the IORT Node Header ParseAcpi ( FALSE, 0, "IORT Node Header", NodePtr, - 16, + AcpiTableLength - Offset, PARSER_PARAMS (IortNodeHeaderParser) ); - if (*IortNodeLength == 0) { + + // Check if the values used to control the parsing logic have been + // successfully read. + if ((IortNodeType == NULL) || + (IortNodeLength == NULL) || + (IortIdMappingCount == NULL) || + (IortIdMappingOffset == NULL)) { IncrementErrorCount (); - Print (L"ERROR: Parser error. Invalid table data.\n"); + Print ( + L"ERROR: Insufficient remaining table buffer length to read the " \ + L"IORT node header. Length = %d.\n", + AcpiTableLength - Offset + ); + return; + } + + // Make sure the IORT Node is inside the table + if ((Offset + (*IortNodeLength)) > AcpiTableLength) { + IncrementErrorCount (); + Print ( + L"ERROR: Invalid IORT node length. IortNodeLength = %d. " \ + L"RemainingTableBufferLength = %d. IORT parsing aborted.\n", + *IortNodeLength, + AcpiTableLength - Offset + ); return; } @@ -689,15 +812,31 @@ ParseAcpiIort ( *IortNodeLength, *IortIdMappingCount, *IortIdMappingOffset - ); + ); break; default: - IncrementErrorCount (); - Print (L"ERROR: Unsupported IORT Node type = %d\n", *IortNodeType); + if (GetConsistencyChecking ()) { + IncrementErrorCount (); + Print (L"ERROR: Unsupported IORT Node type = %d\n", *IortNodeType); + } + break; } // switch NodePtr += (*IortNodeLength); Offset += (*IortNodeLength); } // while + + // Cross-check the substructure count with the length of the encapsulating + // buffer + if (GetConsistencyChecking () && + (Index < *IortNodeCount)) { + IncrementErrorCount (); + Print ( + L"ERROR: Invalid IORT node count. IortNodeCount = %d. " \ + L"AcpiTableLength = %d.\n", + *IortNodeCount, + AcpiTableLength + ); + } } -- 'Guid(CE165669-3EF3-493F-B85D-6190EE5B9759)'