File 2008-Fix-uninitialised-data-in-HII-IFR-s.patch of Package qemu-linux-user.19799

Overview Repositories Revisions Requests Users Attributes Meta

File 2008-Fix-uninitialised-data-in-HII-IFR-s.patch of Package qemu-linux-user.19799

From: Michael Brown <mcb30@ipxe.org>
Date: Wed, 29 Jun 2016 15:13:35 +0100
Subject: Fix uninitialised data in HII IFR structures

The HII IFR structures are allocated via realloc() rather than
zalloc(), and so are not automatically zeroed.  This results in the
presence of uninitialised and invalid data, causing crashes elsewhere
in the UEFI firmware.

Fix by explicitly zeroing the newly allocated portion of any IFR
structure in efi_ifr_op().

Debugged-by: Laszlo Ersek <lersek@redhat.com>
Debugged-by: Gary Lin <glin@suse.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Signed-off-by: Bruce Rogers <brogers@suse.com>
---
 src/interface/efi/efi_hii.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/roms/ipxe/src/interface/efi/efi_hii.c b/roms/ipxe/src/interface/efi/efi_hii.c
index 0ea970e67f666a000aae0fa98ac1..506fc886995ca6bac697e28fc68e 100644
--- a/roms/ipxe/src/interface/efi/efi_hii.c
+++ b/roms/ipxe/src/interface/efi/efi_hii.c
@@ -117,6 +117,7 @@ static void * efi_ifr_op ( struct efi_ifr_builder *ifr, unsigned int opcode,
 	ifr->ops_len = new_ops_len;
 
 	/* Fill in opcode header */
+	memset ( op, 0, len );
 	op->OpCode = opcode;
 	op->Length = len;

Places

File 2008-Fix-uninitialised-data-in-HII-IFR-s.patch of Package qemu-linux-user.19799

Places