Date: Thu, 6 Jul 2017 14:35:47 +0000 (UTC) From: Ed Maste <emaste@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r320736 - head/usr.sbin/acpi/acpidump Message-ID: <201707061435.v66EZlAl043385@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: emaste Date: Thu Jul 6 14:35:47 2017 New Revision: 320736 URL: https://svnweb.freebsd.org/changeset/base/320736 Log: acpidump: warn and exit loop on invalid subtable length Submitted by: Guangyuan Yang <yzgyyang@outlook.com> Sponsored by: The FreeBSD Foundation Modified: head/usr.sbin/acpi/acpidump/acpi.c Modified: head/usr.sbin/acpi/acpidump/acpi.c ============================================================================== --- head/usr.sbin/acpi/acpidump/acpi.c Thu Jul 6 13:27:01 2017 (r320735) +++ head/usr.sbin/acpi/acpidump/acpi.c Thu Jul 6 14:35:47 2017 (r320736) @@ -270,6 +270,10 @@ acpi_walk_subtables(ACPI_TABLE_HEADER *table, void *fi end = (char *)table + table->Length; while ((char *)subtable < end) { printf("\n"); + if (subtable->Length < sizeof(ACPI_SUBTABLE_HEADER)) { + warnx("invalid subtable length %u", subtable->Length); + return; + } action(subtable); subtable = (ACPI_SUBTABLE_HEADER *)((char *)subtable + subtable->Length);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201707061435.v66EZlAl043385>