chiark
/
gitweb
/
~ianmdlvl
/
elogind.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
| inline |
side by side
(from parent 1:
fd201fd
)
acpi-fpdt: break on zero or negative length read
author
Pavel Holica
<conscript89@gmail.com>
Wed, 6 Nov 2013 22:24:16 +0000
(23:24 +0100)
committer
Zbigniew Jędrzejewski-Szmek
<zbyszek@in.waw.pl>
Thu, 7 Nov 2013 06:23:54 +0000
(
01:23
-0500)
https://bugzilla.redhat.com/show_bug.cgi?id=
1027478
src/shared/acpi-fpdt.c
patch
|
blob
|
history
diff --git
a/src/shared/acpi-fpdt.c
b/src/shared/acpi-fpdt.c
index 75648b4d86f91af3a4327c11232d2630c91da6c3..7bae47f85f2fb5199e301233f092a984a002798c 100644
(file)
--- a/
src/shared/acpi-fpdt.c
+++ b/
src/shared/acpi-fpdt.c
@@
-109,6
+109,8
@@
int acpi_get_boot_usec(usec_t *loader_start, usec_t *loader_exit) {
for (rec = (struct acpi_fpdt_header *)(buf + sizeof(struct acpi_table_header));
(char *)rec < buf + l;
rec = (struct acpi_fpdt_header *)((char *)rec + rec->length)) {
+ if (rec->length <= 0)
+ break;
if (rec->type != ACPI_FPDT_TYPE_BOOT)
continue;
if (rec->length != sizeof(struct acpi_fpdt_header))