From: "Sami Mujawar" <sami.mujawar@arm.com>
To: Krzysztof Koch <Krzysztof.Koch@arm.com>,
"devel@edk2.groups.io" <devel@edk2.groups.io>
Cc: "ray.ni@intel.com" <ray.ni@intel.com>,
"zhichao.gao@intel.com" <zhichao.gao@intel.com>,
Matteo Carlini <Matteo.Carlini@arm.com>, nd <nd@arm.com>,
Laura Moretta <Laura.Moretta@arm.com>
Subject: Re: [PATCH v1 1/1] ShellPkg: acpiview: Validate ACPI table 'Length' field
Date: Thu, 30 Jan 2020 16:36:20 +0000 [thread overview]
Message-ID: <DB7PR08MB3097358579489B2224A7DDDD84040@DB7PR08MB3097.eurprd08.prod.outlook.com> (raw)
In-Reply-To: <20200130161958.40212-1-krzysztof.koch@arm.com>
Reviewed-by: Sami Mujawar <sami.mujawar@arm.com>
Regards,
Sami Mujawar
-----Original Message-----
From: Krzysztof Koch <krzysztof.koch@arm.com>
Sent: 30 January 2020 16:20
To: devel@edk2.groups.io
Cc: ray.ni@intel.com; zhichao.gao@intel.com; Matteo Carlini <Matteo.Carlini@arm.com>; Sami Mujawar <Sami.Mujawar@arm.com>; nd <nd@arm.com>
Subject: [PATCH v1 1/1] ShellPkg: acpiview: Validate ACPI table 'Length' field
Check if the ACPI table length, as reported in the ACPI table header, is big enough to fit at least the header itself.
If not, report an error to the user and stop parsing the table in order to prevent buffer overruns.
Signed-off-by: Krzysztof Koch <krzysztof.koch@arm.com>
---
Changes can be seet at: https://github.com/KrzysztofKoch1/edk2/pull/new/650_add_checks_process_acpi_table_v1
Notes:
v1:
- Validate ACPI table length [Krzysztof]
ShellPkg/Library/UefiShellAcpiViewCommandLib/AcpiTableParser.c | 22 +++++++++++++++++++-
1 file changed, 21 insertions(+), 1 deletion(-)
diff --git a/ShellPkg/Library/UefiShellAcpiViewCommandLib/AcpiTableParser.c b/ShellPkg/Library/UefiShellAcpiViewCommandLib/AcpiTableParser.c
index d5500bcb2b4a55c7a69f45444aa49d36d2c1694f..0c93bca4fc0f7d2f105a7654258e00f714fc1519 100644
--- a/ShellPkg/Library/UefiShellAcpiViewCommandLib/AcpiTableParser.c
+++ b/ShellPkg/Library/UefiShellAcpiViewCommandLib/AcpiTableParser.c
@@ -1,7 +1,7 @@
/** @file
ACPI table parser
- Copyright (c) 2016 - 2019, ARM Limited. All rights reserved.
+ Copyright (c) 2016 - 2020, ARM Limited. All rights reserved.
SPDX-License-Identifier: BSD-2-Clause-Patent **/
@@ -176,6 +176,7 @@ ProcessAcpiTable (
CONST UINT32* AcpiTableSignature;
CONST UINT32* AcpiTableLength;
CONST UINT8* AcpiTableRevision;
+ CONST UINT8* SignaturePtr;
PARSE_ACPI_TABLE_PROC ParserProc;
ParseAcpiHeader (
@@ -193,6 +194,25 @@ ProcessAcpiTable (
if (Trace) {
DumpRaw (Ptr, *AcpiTableLength);
+
+ /*
+ Do not process the ACPI table any further if the table length read
+ is invalid. The ACPI table should at least contain the table header.
+ */
+ if (*AcpiTableLength < sizeof (EFI_ACPI_DESCRIPTION_HEADER)) {
+ SignaturePtr = (CONST UINT8*)AcpiTableSignature;
+ IncrementErrorCount ();
+ Print (
+ L"ERROR: Invalid %c%c%c%c table length. Length = %d\n",
+ SignaturePtr[0],
+ SignaturePtr[1],
+ SignaturePtr[2],
+ SignaturePtr[3],
+ *AcpiTableLength
+ );
+ return;
+ }
+
if (GetConsistencyChecking ()) {
VerifyChecksum (TRUE, Ptr, *AcpiTableLength);
}
--
'Guid(CE165669-3EF3-493F-B85D-6190EE5B9759)'
next prev parent reply other threads:[~2020-01-30 16:36 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-01-30 16:19 [PATCH v1 1/1] ShellPkg: acpiview: Validate ACPI table 'Length' field Krzysztof Koch
2020-01-30 16:36 ` Sami Mujawar [this message]
2020-02-11 3:03 ` [edk2-devel] " Gao, Zhichao
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-list from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=DB7PR08MB3097358579489B2224A7DDDD84040@DB7PR08MB3097.eurprd08.prod.outlook.com \
--to=devel@edk2.groups.io \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox