OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

bios linker: validate pointer within table

Browse Source 
buios linker assumes pointer parameter it gets
is within table, validate this.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
This commit is contained in:
Michael S. Tsirkin 2015-02-01 11:54:26 +02:00
parent 16771613a8
commit 12e63900f0
1 changed files with 3 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
hw/acpi/bios-linker-loader.c
View File

@ -141,6 +141,7 @@ void bios_linker_loader_add_pointer(GArray *linker,
uint8_t pointer_size)
{
BiosLinkerLoaderEntry entry;
size_t offset = (gchar *)pointer - table->data;
memset(&entry, 0, sizeof entry);
strncpy(entry.pointer.dest_file, dest_file,
@ -148,7 +149,8 @@ void bios_linker_loader_add_pointer(GArray *linker,
strncpy(entry.pointer.src_file, src_file,
sizeof entry.pointer.src_file - 1);
entry.command = cpu_to_le32(BIOS_LINKER_LOADER_COMMAND_ADD_POINTER);
entry.pointer.offset = cpu_to_le32((gchar *)pointer - table->data);
assert(table->len >= offset + pointer_size);
entry.pointer.offset = cpu_to_le32(offset);
entry.pointer.size = pointer_size;
assert(pointer_size == 1 || pointer_size == 2 ||
pointer_size == 4 || pointer_size == 8);