ShellPkg: acpiview: Prevent infinite loop if structure length is 0

[mirror_edk2.git] / ShellPkg / Library / UefiShellAcpiViewCommandLib / Parsers / Madt / MadtParser.c

diff --git a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c
index 438905cb24f58b8b82e8fe61280e72f765d578d8..f85d2b36532cfc5db36fe7bef9830cccc64969cc 100644 (file)
--- a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c
+++ b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Madt/MadtParser.c
@@ -1,7 +1,7 @@
 /** @file\r
   MADT table parser\r
 \r
-  Copyright (c) 2016 - 2019, ARM Limited. All rights reserved.\r
+  Copyright (c) 2016 - 2020, ARM Limited. All rights reserved.\r
   SPDX-License-Identifier: BSD-2-Clause-Patent\r
 \r
   @par Reference(s):\r
@@ -273,28 +273,16 @@ ParseAcpiMadt (
       return;\r
     }\r
 \r
-    // Make sure forward progress is made.\r
-    if (*MadtInterruptControllerLength < 2) {\r
+    // Validate Interrupt Controller Structure length\r
+    if ((*MadtInterruptControllerLength == 0) ||\r
+        ((Offset + (*MadtInterruptControllerLength)) > AcpiTableLength)) {\r
       IncrementErrorCount ();\r
       Print (\r
-        L"ERROR: Structure length is too small: " \\r
-          L"MadtInterruptControllerLength = %d. " \\r
-          L"MadtInterruptControllerType = %d. MADT parsing aborted.\n",\r
+        L"ERROR: Invalid Interrupt Controller Structure length. " \\r
+          L"Length = %d. Offset = %d. AcpiTableLength = %d.\n",\r
         *MadtInterruptControllerLength,\r
-        *MadtInterruptControllerType\r
-        );\r
-      return;\r
-    }\r
-\r
-    // Make sure the MADT structure lies inside the table\r
-    if ((Offset + *MadtInterruptControllerLength) > AcpiTableLength) {\r
-      IncrementErrorCount ();\r
-      Print (\r
-        L"ERROR: Invalid MADT structure length. " \\r
-          L"MadtInterruptControllerLength = %d. " \\r
-          L"RemainingTableBufferLength = %d. MADT parsing aborted.\n",\r
-        *MadtInterruptControllerLength,\r
-        AcpiTableLength - Offset\r
+        Offset,\r
+        AcpiTableLength\r
         );\r
       return;\r
     }\r