OvmfPkg/X86QemuLoadImageLib: Handle allocation failure for CommandLine

The CommandLine and InitrdData may be set to NULL if the provided
size is too large. Because the zero page is mapped, this would not
cause an immediate crash but can lead to memory corruption instead.
This patch just adds validation and returns error if either allocation
has failed.

Signed-off-by: Martin Radev <martin.b.radev@gmail.com>
Message-Id: <YFPJsaGzVWQxoEU4@martin-ThinkPad-T440p>
Acked-by: Ard Biesheuvel <ardb@kernel.org>
Acked-by: Tom Lendacky <thomas.lendacky@amd.com>
[lersek@redhat.com: drop unnecessary empty line from code; remove personal
 (hence likely unstable) repo reference from commit message]
Reviewed-by: Laszlo Ersek <lersek@redhat.com>

diff --git a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
index 931553c0c1fb2dc315be98eea5bbc91222fb5eb6..1177582ab05134080b68a7d09cee475f5e754c90 100644 (file)
--- a/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
+++ b/OvmfPkg/Library/X86QemuLoadImageLib/X86QemuLoadImageLib.c
@@ -161,6 +161,11 @@ QemuLoadLegacyImage (
     LoadedImage->CommandLine = LoadLinuxAllocateCommandLinePages (\r
                                  EFI_SIZE_TO_PAGES (\r
                                    LoadedImage->CommandLineSize));\r
+    if (LoadedImage->CommandLine == NULL) {\r
+      DEBUG ((DEBUG_ERROR, "Unable to allocate memory for kernel command line!\n"));\r
+      Status = EFI_OUT_OF_RESOURCES;\r
+      goto FreeImage;\r
+    }\r
     QemuFwCfgSelectItem (QemuFwCfgItemCommandLineData);\r
     QemuFwCfgReadBytes (LoadedImage->CommandLineSize, LoadedImage->CommandLine);\r
   }\r
@@ -178,6 +183,11 @@ QemuLoadLegacyImage (
     LoadedImage->InitrdData = LoadLinuxAllocateInitrdPages (\r
                                 LoadedImage->SetupBuf,\r
                                 EFI_SIZE_TO_PAGES (LoadedImage->InitrdSize));\r
+    if (LoadedImage->InitrdData == NULL) {\r
+      DEBUG ((DEBUG_ERROR, "Unable to allocate memory for initrd!\n"));\r
+      Status = EFI_OUT_OF_RESOURCES;\r
+      goto FreeImage;\r
+    }\r
     DEBUG ((DEBUG_INFO, "Initrd size: 0x%x\n",\r
       (UINT32)LoadedImage->InitrdSize));\r
     DEBUG ((DEBUG_INFO, "Reading initrd image ..."));\r