renegade-project/linux-next
2
0
Fork 0
mirror of https://github.com/edk2-porting/linux-next.git synced 2024-12-28 15:13:55 +08:00
Code

efi/libstub: Don't parse overlong command lines

Browse Source 
Check if the command line passed in is larger than COMMAND_LINE_SIZE,
and truncate it to the last full argument if so.

Signed-off-by: Arvind Sankar <nivedita@alum.mit.edu>
Link: https://lore.kernel.org/r/20200521002921.69650-1-nivedita@alum.mit.edu
Signed-off-by: Ard Biesheuvel <ardb@kernel.org>
This commit is contained in:
Arvind Sankar 2020-05-20 20:29:21 -04:00 committed by Ard Biesheuvel
parent 04b24409b4
commit 80b1bfe1cb
1 changed files with 23 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

28
drivers/firmware/efi/libstub/efi-stub-helper.c
View File

@ -9,10 +9,12 @@
#include <stdarg.h> #include <stdarg.h>
#include <linux/ctype.h>
#include <linux/efi.h> #include <linux/efi.h>
#include <linux/kernel.h> #include <linux/kernel.h>
#include <linux/printk.h> /* For CONSOLE_LOGLEVEL_* */ #include <linux/printk.h> /* For CONSOLE_LOGLEVEL_* */
#include <asm/efi.h> #include <asm/efi.h>
#include <asm/setup.h>
#include "efistub.h" #include "efistub.h"
@ -217,22 +219,33 @@ char *efi_convert_cmdline(efi_loaded_image_t *image,
unsigned long cmdline_addr = 0; unsigned long cmdline_addr = 0;
int options_chars = efi_table_attr(image, load_options_size) / 2; int options_chars = efi_table_attr(image, load_options_size) / 2;
const u16 *options = efi_table_attr(image, load_options); const u16 *options = efi_table_attr(image, load_options);
int options_bytes = 0; /* UTF-8 bytes */ int options_bytes = 0, safe_options_bytes = 0; /* UTF-8 bytes */
bool in_quote = false;
efi_status_t status; efi_status_t status;
if (options) { if (options) {
s2 = options; s2 = options;
while (options_chars--) { while (options_bytes < COMMAND_LINE_SIZE && options_chars--) {
u16 c = *s2++; u16 c = *s2++;
if (c == L'\0' || c == L'\n') if (c < 0x80) {
break; if (c == L'\0' || c == L'\n')
break;
if (c == L'"')
in_quote = !in_quote;
else if (!in_quote && isspace((char)c))
safe_options_bytes = options_bytes;
options_bytes++;
continue;
}
/* /*
* Get the number of UTF-8 bytes corresponding to a * Get the number of UTF-8 bytes corresponding to a
* UTF-16 character. * UTF-16 character.
* The first part handles everything in the BMP. * The first part handles everything in the BMP.
*/ */
options_bytes += 1 + (c >= 0x80) + (c >= 0x800); options_bytes += 2 + (c >= 0x800);
/* /*
* Add one more byte for valid surrogate pairs. Invalid * Add one more byte for valid surrogate pairs. Invalid
* surrogates will be replaced with 0xfffd and take up * surrogates will be replaced with 0xfffd and take up
@ -253,6 +266,11 @@ char *efi_convert_cmdline(efi_loaded_image_t *image,
} }
} }
} }
if (options_bytes >= COMMAND_LINE_SIZE) {
options_bytes = safe_options_bytes;
efi_err("Command line is too long: truncated to %d bytes\n",
options_bytes);
}
} }
options_bytes++; /* NUL termination */ options_bytes++; /* NUL termination */