ShellPkg: acpiview: IORT: Validate global pointers before use

[mirror_edk2.git] / ShellPkg / Library / UefiShellAcpiViewCommandLib / Parsers / Iort / IortParser.c

diff --git a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Iort/IortParser.c b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Iort/IortParser.c
index 72289c7680bc3cd5c444481e8d6a719803202a9b..9d5d937c7b2c19945ca2ad3eba644bdfc09cc3f6 100644 (file)
--- a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Iort/IortParser.c
+++ b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Iort/IortParser.c
@@ -322,6 +322,20 @@ DumpIortNodeSmmuV1V2 (
     PARSER_PARAMS (IortNodeSmmuV1V2Parser)\r
     );\r
 \r
+  // Check if the values used to control the parsing logic have been\r
+  // successfully read.\r
+  if ((InterruptContextCount == NULL)   ||\r
+      (InterruptContextOffset == NULL)  ||\r
+      (PmuInterruptCount == NULL)       ||\r
+      (PmuInterruptOffset == NULL)) {\r
+    IncrementErrorCount ();\r
+    Print (\r
+      L"ERROR: Insufficient SMMUv1/2 node length. Length = %d\n",\r
+      Length\r
+      );\r
+    return;\r
+  }\r
+\r
   Offset = *InterruptContextOffset;\r
   Index = 0;\r
 \r
@@ -433,6 +447,17 @@ DumpIortNodeIts (
             PARSER_PARAMS (IortNodeItsParser)\r
             );\r
 \r
+  // Check if the values used to control the parsing logic have been\r
+  // successfully read.\r
+  if (ItsCount == NULL) {\r
+    IncrementErrorCount ();\r
+    Print (\r
+      L"ERROR: Insufficient ITS group length. Length = %d.\n",\r
+      Length\r
+      );\r
+    return;\r
+  }\r
+\r
   Index = 0;\r
 \r
   while ((Index < *ItsCount) &&\r
@@ -617,6 +642,18 @@ ParseAcpiIort (
     PARSER_PARAMS (IortParser)\r
     );\r
 \r
+  // Check if the values used to control the parsing logic have been\r
+  // successfully read.\r
+  if ((IortNodeCount == NULL) ||\r
+      (IortNodeOffset == NULL)) {\r
+    IncrementErrorCount ();\r
+    Print (\r
+      L"ERROR: Insufficient table length. AcpiTableLength = %d.\n",\r
+      AcpiTableLength\r
+      );\r
+    return;\r
+  }\r
+\r
   Offset = *IortNodeOffset;\r
   NodePtr = Ptr + Offset;\r
   Index = 0;\r
@@ -635,6 +672,21 @@ ParseAcpiIort (
       PARSER_PARAMS (IortNodeHeaderParser)\r
       );\r
 \r
+    // Check if the values used to control the parsing logic have been\r
+    // successfully read.\r
+    if ((IortNodeType == NULL)        ||\r
+        (IortNodeLength == NULL)      ||\r
+        (IortIdMappingCount == NULL)  ||\r
+        (IortIdMappingOffset == NULL)) {\r
+      IncrementErrorCount ();\r
+      Print (\r
+        L"ERROR: Insufficient remaining table buffer length to read the " \\r
+          L"IORT node header. Length = %d.\n",\r
+        AcpiTableLength - Offset\r
+        );\r
+      return;\r
+    }\r
+\r
     // Make sure the IORT Node is inside the table\r
     if ((Offset + (*IortNodeLength)) > AcpiTableLength) {\r
       IncrementErrorCount ();\r