浏览代码

ACPICA: Added additional parameter validation for LoadTable

Implemented additional parameter validation for the LoadTable
operator. The length of the input strings SignatureString,
OemIdString, and OemTableId are now checked for maximum
lengths.

http://www.acpica.org/bugzilla/show_bug.cgi?id=582

Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Lin Ming 17 年之前
父节点
当前提交
49718b1741
共有 1 个文件被更改,包括 8 次插入0 次删除
  1. 8 0
      drivers/acpi/executer/exconfig.c

+ 8 - 0
drivers/acpi/executer/exconfig.c

@@ -138,6 +138,14 @@ acpi_ex_load_table_op(struct acpi_walk_state *walk_state,
 
 
 	ACPI_FUNCTION_TRACE(ex_load_table_op);
 	ACPI_FUNCTION_TRACE(ex_load_table_op);
 
 
+	/* Validate lengths for the signature_string, OEMIDString, OEMtable_iD */
+
+	if ((operand[0]->string.length > ACPI_NAME_SIZE) ||
+	    (operand[1]->string.length > ACPI_OEM_ID_SIZE) ||
+	    (operand[2]->string.length > ACPI_OEM_TABLE_ID_SIZE)) {
+		return_ACPI_STATUS(AE_BAD_PARAMETER);
+	}
+
 	/* Find the ACPI table in the RSDT/XSDT */
 	/* Find the ACPI table in the RSDT/XSDT */
 
 
 	status = acpi_tb_find_table(operand[0]->string.pointer,
 	status = acpi_tb_find_table(operand[0]->string.pointer,