Author: imp
Date: Fri Oct 26 23:08:22 2018
New Revision: 339800
URL: https://svnweb.freebsd.org/changeset/base/339800
Log:
Ensure we have a full EFI_DEVICE_PATH header before we try to look at
its length. Some BIOSes pad the length of the device path to an even
amount. When we had a device path that was somehow an odd length, we'd
wind up having 1 byte left that we were bogusly interpreting as a full
device path. We'd then dereference 2 bytes into that to get a length
of the node, which had undefined (and quite undesired) effects.
Sponsored by: Netflix, Inc
MFC After: 3 days
Modified:
head/stand/efi/loader/main.c
Modified: head/stand/efi/loader/main.c
==============================================================================
--- head/stand/efi/loader/main.c Fri Oct 26 22:49:36 2018
(r339799)
+++ head/stand/efi/loader/main.c Fri Oct 26 23:08:22 2018
(r339800)
@@ -349,7 +349,7 @@ match_boot_info(EFI_LOADED_IMAGE *img __unused, char *
edp = (EFI_DEVICE_PATH *)(walker + fplen);
if ((char *)edp > ep)
return NOT_SPECIFIC;
- while (dp < edp) {
+ while (dp < edp && (size_t)(edp - dp) > sizeof(EFI_DEVICE_PATH)) {
text = efi_devpath_name(dp);
if (text != NULL) {
printf(" BootInfo Path: %S\n", text);
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
