ShellPkg: acpiview: SRAT: Prevent buffer overruns

[mirror_edk2.git] / ShellPkg / Library / UefiShellAcpiViewCommandLib / Parsers / Srat / SratParser.c

diff --git a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Srat/SratParser.c b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Srat/SratParser.c
index 59c77401eaab32b73a9f83fd4d63785221b3c222..a8aa420487bb6bf29fc38221d0b221573c64b8b3 100644 (file)
--- a/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Srat/SratParser.c
+++ b/ShellPkg/Library/UefiShellAcpiViewCommandLib/Parsers/Srat/SratParser.c
@@ -215,10 +215,22 @@ ParseAcpiSrat (
       0,\r
       NULL,\r
       ResourcePtr,\r
-      2,  // The length is 1 byte at offset 1\r
+      AcpiTableLength - Offset,\r
       PARSER_PARAMS (SratResourceAllocationParser)\r
       );\r
 \r
+    // Make sure the SRAT structure lies inside the table\r
+    if ((Offset + *SratRALength) > AcpiTableLength) {\r
+      IncrementErrorCount ();\r
+      Print (\r
+        L"ERROR: Invalid SRAT structure length. SratRALength = %d. " \\r
+          L"RemainingTableBufferLength = %d. SRAT parsing aborted.\n",\r
+        *SratRALength,\r
+        AcpiTableLength - Offset\r
+        );\r
+      return;\r
+    }\r
+\r
     switch (*SratRAType) {\r
       case EFI_ACPI_6_2_GICC_AFFINITY:\r
         AsciiSPrint (\r