From c4a53853c10bee5be821cf0df2d1514d0cff7dc9 Mon Sep 17 00:00:00 2001 From: Krzysztof Koch Date: Mon, 20 Jan 2020 19:13:47 +0800 Subject: ShellPkg: acpiview: MADT: Validate global pointers before use Check if the MadtInterruptControllerType and MadtInterruptControllerLength pointers have been successfully updated before they are used for further table parsing. Signed-off-by: Krzysztof Koch --- .../UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) (limited to 'ShellPkg') diff --git a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c index 90bdafea19..438905cb24 100644 --- a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c +++ b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c @@ -260,6 +260,19 @@ ParseAcpiMadt ( PARSER_PARAMS (MadtInterruptControllerHeaderParser) ); + // Check if the values used to control the parsing logic have been + // successfully read. + if ((MadtInterruptControllerType == NULL) || + (MadtInterruptControllerLength == NULL)) { + IncrementErrorCount (); + Print ( + L"ERROR: Insufficient remaining table buffer length to read the " \ + L"Interrupt Controller Structure header. Length = %d.\n", + AcpiTableLength - Offset + ); + return; + } + // Make sure forward progress is made. if (*MadtInterruptControllerLength < 2) { IncrementErrorCount (); -- cgit v1.2.3