OvmfPkg/X86QemuLoadImageLib: Handle allocation failure for CommandLine

The CommandLine and InitrdData may be set to NULL if the provided
size is too large. Because the zero page is mapped, this would not
cause an immediate crash but can lead to memory corruption instead.
This patch just adds validation and returns error if either allocation
has failed.

Signed-off-by: Martin Radev <martin.b.radev@gmail.com>
Message-Id: <YFPJsaGzVWQxoEU4@martin-ThinkPad-T440p>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
[lersek@redhat.com: drop unnecessary empty line from code; remove personal
 (hence likely unstable) repo reference from commit message]
Reviewed-by: Laszlo Ersek <lersek@redhat.com>

1 files changed, 10 insertions, 0 deletions

diff --git a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
index 931553c0c1..1177582ab0 100644
--- a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
+++ b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
@@ -161,6 +161,11 @@ QemuLoadLegacyImage (
     LoadedImage->CommandLine = LoadLinuxAllocateCommandLinePages (

                                  EFI_SIZE_TO_PAGES (

                                    LoadedImage->CommandLineSize));

+    if (LoadedImage->CommandLine == NULL) {

+      DEBUG ((DEBUG_ERROR, "Unable to allocate memory for kernel command line!\n"));

+      Status = EFI_OUT_OF_RESOURCES;

+      goto FreeImage;

+    }

     QemuFwCfgSelectItem (QemuFwCfgItemCommandLineData);

     QemuFwCfgReadBytes (LoadedImage->CommandLineSize, LoadedImage->CommandLine);

   }

@@ -178,6 +183,11 @@ QemuLoadLegacyImage (
     LoadedImage->InitrdData = LoadLinuxAllocateInitrdPages (

                                 LoadedImage->SetupBuf,

                                 EFI_SIZE_TO_PAGES (LoadedImage->InitrdSize));

+    if (LoadedImage->InitrdData == NULL) {

+      DEBUG ((DEBUG_ERROR, "Unable to allocate memory for initrd!\n"));

+      Status = EFI_OUT_OF_RESOURCES;

+      goto FreeImage;

+    }

     DEBUG ((DEBUG_INFO, "Initrd size: 0x%x\n",

       (UINT32)LoadedImage->InitrdSize));

     DEBUG ((DEBUG_INFO, "Reading initrd image ..."));