mirror of
https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git
synced 2026-10-06 03:45:24 -04:00
| Filename | Latest commit message | Latest commit date |
|---|---|---|
2ca55d221b
[ Upstream commit 64b9dfd0776e9c38d733094859a09f13282ce6f8 ]
ACPICA commit 8b83a8d88dfec59ea147fad35fc6deea8859c58c
ap_get_table_length() checks if tables are valid by
calling ap_is_valid_header(). The latter then calls
ACPI_VALIDATE_RSDP_SIG(Table->Signature).
ap_is_valid_header() accepts struct acpi_table_header as an argument, so
the signature size is always fixed to 4 bytes.
The problem is when the string comparison is between ACPI-defined table
signature and ACPI_SIG_RSDP. Common ACPI table header specifies the
Signature field to be 4 bytes long[1], with the exception of the RSDP
structure whose signature is 8 bytes long "RSD PTR " (including the
trailing blank character)[2]. Calling strncmp(sig, rsdp_sig, 8) would
then result in a sequence overread[3] as sig would be smaller (4 bytes)
than the specified bound (8 bytes).
As a workaround, pass the bound conditionally based on the size of the
signature being passed.
Link: https://uefi.org/specs/ACPI/6.5_A/05_ACPI_Software_Programming_Model.html#system-description-table-header [1]
Link: https://uefi.org/specs/ACPI/6.5_A/05_ACPI_Software_Programming_Model.html#root-system-description-pointer-rsdp-structure [2]
Link: https://gcc.gnu.org/onlinedocs/gcc/Warning-Options.html#index-Wstringop-overread [3]
Link:
|
||
| .. | ||
| platform | ||
| acbuffer.h | ||
| acconfig.h | ||
| acexcep.h | ||
| acnames.h | ||
| acoutput.h | ||
| acpi.h | ||
| acpi_bus.h | ||
| acpi_drivers.h | ||
| acpi_io.h | ||
| acpi_lpat.h | ||
| acpi_numa.h | ||
| acpiosxf.h | ||
| acpixf.h | ||
| acrestyp.h | ||
| actbl.h | ||
| actbl1.h | ||
| actbl2.h | ||
| actbl3.h | ||
| actypes.h | ||
| acuuid.h | ||
| apei.h | ||
| battery.h | ||
| button.h | ||
| cppc_acpi.h | ||
| ghes.h | ||
| hed.h | ||
| nfit.h | ||
| pcc.h | ||
| pdc_intel.h | ||
| processor.h | ||
| reboot.h | ||
| video.h | ||