sysadmin/ipxe
1
0
Fork 0
mirror of https://github.com/ipxe/ipxe synced 2026-02-14 02:31:26 +03:00
Code Issues Packages Projects Releases Wiki Activity

[efi] Avoid integer underflow on malformed USB string descriptors

Browse Source 
Signed-off-by: Michael Brown <mcb30@ipxe.org>
This commit is contained in:
Michael Brown
2020-10-01 18:33:12 +01:00
parent 7c6fdf57ea
commit 02280dc642
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
src/interface/efi/efi_usb.c
View File

@@ -981,6 +981,12 @@ efi_usb_get_string_descriptor ( EFI_USB_IO_PROTOCOL *usbio, UINT16 language,
goto err_get_header; goto err_get_header;
} }
len = header.len; len = header.len;
if ( len < sizeof ( header ) ) {
DBGC ( usbdev, "USBDEV %s underlength string %d:%d\n",
usbintf->name, language, index );
rc = -EINVAL;
goto err_len;
}
/* Allocate buffer */ /* Allocate buffer */
if ( ( efirc = bs->AllocatePool ( EfiBootServicesData, len, if ( ( efirc = bs->AllocatePool ( EfiBootServicesData, len,
@@ -1014,6 +1020,7 @@ efi_usb_get_string_descriptor ( EFI_USB_IO_PROTOCOL *usbio, UINT16 language,
err_get_descriptor: err_get_descriptor:
bs->FreePool ( buffer ); bs->FreePool ( buffer );
err_alloc: err_alloc:
err_len:
err_get_header: err_get_header:
bs->RestoreTPL ( saved_tpl ); bs->RestoreTPL ( saved_tpl );
return EFIRC ( rc ); return EFIRC ( rc );