diff options
| author | Brian Foley <bpfoley@google.com> | 2022-02-14 22:51:18 +0000 |
|---|---|---|
| committer | Brian Foley <bpfoley@google.com> | 2022-02-14 23:09:15 +0000 |
| commit | 09a9a0808ba4997173ecb5c6ec3bdb1f2d0d50b5 (patch) | |
| tree | 6e9d920fb1696fdc1aa8c1002a81dd6d277a9b0a | |
| parent | c7de0c217e072fe11bcc74b4745b9df58c51df9e (diff) | |
| download | acpica-09a9a0808ba4997173ecb5c6ec3bdb1f2d0d50b5.tar.gz | |
Fix buffer overflow when disassembling anonymous ResourceTemplate()
AcpiDmPredefinedDescription only works if acpi_parse_object is Named
rather than Common.
Without this check, an ASAN build of the disassembler will fail
with an out of bounds error when trying to disassemble code like
Store(ResourceTemplate() {
QWordMemory (
ResourceProducer, PosDecode, MinFixed, MaxFixed, Cacheable,
ReadWrite, 0, 0, 6, 0, 7, , , , AddressRangeMemory, TypeStatic)
}, Local2)
This particular case was reduced from code in seabios
| -rw-r--r-- | source/components/disassembler/dmwalk.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/source/components/disassembler/dmwalk.c b/source/components/disassembler/dmwalk.c index 75d75eab3..f35fb6678 100644 --- a/source/components/disassembler/dmwalk.c +++ b/source/components/disassembler/dmwalk.c @@ -959,7 +959,15 @@ AcpiDmDescendingOp ( NextOp->Common.DisasmFlags |= ACPI_PARSEOP_IGNORE; ASL_CV_CLOSE_PAREN (Op, Level); - /* Emit description comment for Name() with a predefined ACPI name */ + if (Op->Asl.Parent->Common.AmlOpcode == AML_NAME_OP) + { + /* + * Emit description comment showing the full ACPI name + * of the ResourceTemplate only if it was defined using a + * Name statement. + */ + AcpiDmPredefinedDescription (Op->Asl.Parent); + } AcpiDmPredefinedDescription (Op->Asl.Parent); |