Prep v220: Apply "Fixes to user and session saving"

[elogind.git] / src / shared / acpi-fpdt.c

diff --git a/src/shared/acpi-fpdt.c b/src/shared/acpi-fpdt.c
index af58c7cca6b81dd5e63067a8b4f04c2c3363aaf8..64e50401b9d0a586a390cbdba8e11fa9af9d3044 100644 (file)
--- a/src/shared/acpi-fpdt.c
+++ b/src/shared/acpi-fpdt.c
@@ -19,13 +19,11 @@
   along with systemd; If not, see <http://www.gnu.org/licenses/>.
 ***/
 
-#include <stdlib.h>
 #include <stdio.h>
 #include <stdint.h>
 #include <string.h>
 #include <unistd.h>
 #include <fcntl.h>
-#include <sys/types.h>
 
 #include <util.h>
 #include <fileio.h>
@@ -83,7 +81,7 @@ struct acpi_fpdt_boot {
 int acpi_get_boot_usec(usec_t *loader_start, usec_t *loader_exit) {
         _cleanup_free_ char *buf = NULL;
         struct acpi_table_header *tbl;
-        size_t l;
+        size_t l = 0;
         struct acpi_fpdt_header *rec;
         int r;
         uint64_t ptr = 0;
@@ -109,6 +107,8 @@ int acpi_get_boot_usec(usec_t *loader_start, usec_t *loader_exit) {
         for (rec = (struct acpi_fpdt_header *)(buf + sizeof(struct acpi_table_header));
              (char *)rec < buf + l;
              rec = (struct acpi_fpdt_header *)((char *)rec + rec->length)) {
+                if (rec->length <= 0)
+                        break;
                 if (rec->type != ACPI_FPDT_TYPE_BOOT)
                         continue;
                 if (rec->length != sizeof(struct acpi_fpdt_header))
@@ -146,6 +146,11 @@ int acpi_get_boot_usec(usec_t *loader_start, usec_t *loader_exit) {
         if (brec.type != ACPI_FPDT_BOOT_REC)
                 return -EINVAL;
 
+        if (brec.startup_start == 0 || brec.exit_services_exit < brec.startup_start)
+                return -EINVAL;
+        if (brec.exit_services_exit > NSEC_PER_HOUR)
+                return -EINVAL;
+
         if (loader_start)
                 *loader_start = brec.startup_start / 1000;
         if (loader_exit)