diff options
| author | Lennart Poettering <lennart@poettering.net> | 2022-11-09 15:16:09 +0100 |
|---|---|---|
| committer | Lennart Poettering <lennart@poettering.net> | 2022-11-09 15:16:12 +0100 |
| commit | 31edf44064fa3c0a83514f5633b0c2763102faaf (patch) | |
| tree | f28f25792291e44cfc126d98be316fbb3b5d5da4 /src/shared | |
| parent | 8cee3283f0ca98adccb3066fc4d19a6428958eaf (diff) | |
| download | systemd-31edf44064fa3c0a83514f5633b0c2763102faaf.tar.gz | |
acpi-fpdt: make sure length/type fields are available in acpi_fpdt_header
some extra safety: make sure the two fields we care about are actually
properly present before the buffer is over.
Diffstat (limited to 'src/shared')
| -rw-r--r-- | src/shared/acpi-fpdt.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/src/shared/acpi-fpdt.c b/src/shared/acpi-fpdt.c index 0a91b38ab0..668f6c3eee 100644 --- a/src/shared/acpi-fpdt.c +++ b/src/shared/acpi-fpdt.c @@ -89,7 +89,7 @@ int acpi_get_boot_usec(usec_t *ret_loader_start, usec_t *ret_loader_exit) { /* find Firmware Basic Boot Performance Pointer Record */ for (rec = (struct acpi_fpdt_header *)(buf + sizeof(struct acpi_table_header)); - (char *)rec < buf + l; + (char *)rec + offsetof(struct acpi_fpdt_header, revision) <= buf + l; rec = (struct acpi_fpdt_header *)((char *)rec + rec->length)) { if (rec->length <= 0) break; |