From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: mx.groups.io; dkim=missing; spf=pass (domain: intel.com, ip: 192.55.52.115, mailfrom: nathaniel.l.desimone@intel.com) Received: from mga14.intel.com (mga14.intel.com [192.55.52.115]) by groups.io with SMTP; Mon, 15 Jul 2019 13:39:57 -0700 X-Amp-Result: SKIPPED(no attachment in message) X-Amp-File-Uploaded: False Received: from orsmga004.jf.intel.com ([10.7.209.38]) by fmsmga103.fm.intel.com with ESMTP/TLS/DHE-RSA-AES256-GCM-SHA384; 15 Jul 2019 13:39:56 -0700 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.63,494,1557212400"; d="scan'208";a="318784580" Received: from nldesimo-desk1.amr.corp.intel.com ([10.7.159.63]) by orsmga004.jf.intel.com with ESMTP; 15 Jul 2019 13:39:56 -0700 From: "Nate DeSimone" To: devel@edk2.groups.io Cc: Chasel Chiu , Michael A Kubacki , Sai Chaganty Subject: [edk2-platforms] [PATCH] KabylakeSiliconPkg: Possible out-of-bounds memory writes Date: Mon, 15 Jul 2019 13:39:33 -0700 Message-Id: <20190715203933.29256-1-nathaniel.l.desimone@intel.com> X-Mailer: git-send-email 2.17.1.windows.2 - Add check for the DSDT not existing. - Fixed logic errors in loop boundary check. Cc: Chasel Chiu Cc: Michael A Kubacki Cc: Sai Chaganty Co-authored-by: John Mathews Signed-off-by: Nate DeSimone --- .../Library/DxeAslUpdateLib/DxeAslUpdateLib.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/Silicon/Intel/KabylakeSiliconPkg/Library/DxeAslUpdateLib/DxeAslUpdateLib.c b/Silicon/Intel/KabylakeSiliconPkg/Library/DxeAslUpdateLib/DxeAslUpdateLib.c index e6ab43db6d..a9611f750f 100644 --- a/Silicon/Intel/KabylakeSiliconPkg/Library/DxeAslUpdateLib/DxeAslUpdateLib.c +++ b/Silicon/Intel/KabylakeSiliconPkg/Library/DxeAslUpdateLib/DxeAslUpdateLib.c @@ -59,6 +59,7 @@ InitializeAslUpdateLib ( @param[in] Length - length of data to be overwritten @retval EFI_SUCCESS - The function completed successfully. + @retval EFI_NOT_FOUND - Failed to locate AcpiTable. **/ EFI_STATUS UpdateNameAslCode ( @@ -99,11 +100,14 @@ UpdateNameAslCode ( /// Point to the beginning of the DSDT table /// CurrPtr = (UINT8 *) Table; + if (CurrPtr == NULL) { + return EFI_NOT_FOUND; + } /// /// Loop through the ASL looking for values that we must fix up. /// - for (DsdtPointer = CurrPtr; DsdtPointer <= (CurrPtr + ((EFI_ACPI_COMMON_HEADER *) CurrPtr)->Length); DsdtPointer++) { + for (DsdtPointer = CurrPtr; DsdtPointer < (CurrPtr + ((EFI_ACPI_COMMON_HEADER *) CurrPtr)->Length); DsdtPointer++) { /// /// Get a pointer to compare for signature /// -- 2.17.1.windows.2