From: Lin Ming Date: Thu, 10 Apr 2008 15:06:40 +0000 (+0400) Subject: ACPICA: Added additional parameter validation for LoadTable X-Git-Tag: v2.6.26-rc1~101^2~42 X-Git-Url: https://err.no/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=49718b1741cb74d86eb8b1bd8f52ad6a013b40df;p=linux-2.6 ACPICA: Added additional parameter validation for LoadTable Implemented additional parameter validation for the LoadTable operator. The length of the input strings SignatureString, OemIdString, and OemTableId are now checked for maximum lengths. http://www.acpica.org/bugzilla/show_bug.cgi?id=582 Signed-off-by: Lin Ming Signed-off-by: Bob Moore Signed-off-by: Alexey Starikovskiy Signed-off-by: Len Brown --- diff --git a/drivers/acpi/executer/exconfig.c b/drivers/acpi/executer/exconfig.c index b9543a7f5d..3370aad3ee 100644 --- a/drivers/acpi/executer/exconfig.c +++ b/drivers/acpi/executer/exconfig.c @@ -138,6 +138,14 @@ acpi_ex_load_table_op(struct acpi_walk_state *walk_state, ACPI_FUNCTION_TRACE(ex_load_table_op); + /* Validate lengths for the signature_string, OEMIDString, OEMtable_iD */ + + if ((operand[0]->string.length > ACPI_NAME_SIZE) || + (operand[1]->string.length > ACPI_OEM_ID_SIZE) || + (operand[2]->string.length > ACPI_OEM_TABLE_ID_SIZE)) { + return_ACPI_STATUS(AE_BAD_PARAMETER); + } + /* Find the ACPI table in the RSDT/XSDT */ status = acpi_tb_find_table(operand[0]->string.pointer,