diff options
| author | Lin Ming <ming.m.lin@intel.com> | 2008-04-10 17:06:40 +0200 |
|---|---|---|
| committer | Len Brown <len.brown@intel.com> | 2008-04-22 20:29:26 +0200 |
| commit | 49718b1741cb74d86eb8b1bd8f52ad6a013b40df (patch) | |
| tree | 3aa0b922a31385983a3412a64fddb70d2e538442 /drivers | |
| parent | ACPICA: Fix for Increment/Decrement operator, incorrect type change (diff) | |
| download | linux-49718b1741cb74d86eb8b1bd8f52ad6a013b40df.tar.xz linux-49718b1741cb74d86eb8b1bd8f52ad6a013b40df.zip | |
ACPICA: Added additional parameter validation for LoadTable
Implemented additional parameter validation for the LoadTable
operator. The length of the input strings SignatureString,
OemIdString, and OemTableId are now checked for maximum
lengths.
http://www.acpica.org/bugzilla/show_bug.cgi?id=582
Signed-off-by: Lin Ming <ming.m.lin@intel.com>
Signed-off-by: Bob Moore <robert.moore@intel.com>
Signed-off-by: Alexey Starikovskiy <astarikovskiy@suse.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Diffstat (limited to '')
| -rw-r--r-- | drivers/acpi/executer/exconfig.c | 8 |
1 files changed, 8 insertions, 0 deletions
diff --git a/drivers/acpi/executer/exconfig.c b/drivers/acpi/executer/exconfig.c index b9543a7f5d21..3370aad3ee14 100644 --- a/drivers/acpi/executer/exconfig.c +++ b/drivers/acpi/executer/exconfig.c @@ -138,6 +138,14 @@ acpi_ex_load_table_op(struct acpi_walk_state *walk_state, ACPI_FUNCTION_TRACE(ex_load_table_op); + /* Validate lengths for the signature_string, OEMIDString, OEMtable_iD */ + + if ((operand[0]->string.length > ACPI_NAME_SIZE) || + (operand[1]->string.length > ACPI_OEM_ID_SIZE) || + (operand[2]->string.length > ACPI_OEM_TABLE_ID_SIZE)) { + return_ACPI_STATUS(AE_BAD_PARAMETER); + } + /* Find the ACPI table in the RSDT/XSDT */ status = acpi_tb_find_table(operand[0]->string.pointer, |