From ca318882714080fb81fe9eb89a7b7934efc5bfae Mon Sep 17 00:00:00 2001 From: Martin Radev Date: Thu, 18 Mar 2021 22:44:17 +0100 Subject: OvmfPkg/X86QemuLoadImageLib: Handle allocation failure for CommandLine The CommandLine and InitrdData may be set to NULL if the provided size is too large. Because the zero page is mapped, this would not cause an immediate crash but can lead to memory corruption instead. This patch just adds validation and returns error if either allocation has failed. Signed-off-by: Martin Radev Message-Id: Acked-by: Ard Biesheuvel Acked-by: Tom Lendacky [lersek@redhat.com: drop unnecessary empty line from code; remove personal (hence likely unstable) repo reference from commit message] Reviewed-by: Laszlo Ersek --- OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'OvmfPkg/Library') diff --git a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c index 931553c0c1..1177582ab0 100644 --- a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c +++ b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c @@ -161,6 +161,11 @@ QemuLoadLegacyImage ( LoadedImage->CommandLine = LoadLinuxAllocateCommandLinePages ( EFI_SIZE_TO_PAGES ( LoadedImage->CommandLineSize)); + if (LoadedImage->CommandLine == NULL) { + DEBUG ((DEBUG_ERROR, "Unable to allocate memory for kernel command line!\n")); + Status = EFI_OUT_OF_RESOURCES; + goto FreeImage; + } QemuFwCfgSelectItem (QemuFwCfgItemCommandLineData); QemuFwCfgReadBytes (LoadedImage->CommandLineSize, LoadedImage->CommandLine); } @@ -178,6 +183,11 @@ QemuLoadLegacyImage ( LoadedImage->InitrdData = LoadLinuxAllocateInitrdPages ( LoadedImage->SetupBuf, EFI_SIZE_TO_PAGES (LoadedImage->InitrdSize)); + if (LoadedImage->InitrdData == NULL) { + DEBUG ((DEBUG_ERROR, "Unable to allocate memory for initrd!\n")); + Status = EFI_OUT_OF_RESOURCES; + goto FreeImage; + } DEBUG ((DEBUG_INFO, "Initrd size: 0x%x\n", (UINT32)LoadedImage->InitrdSize)); DEBUG ((DEBUG_INFO, "Reading initrd image ...")); -- cgit v1.2.3