diff options
Diffstat (limited to 'source/components/disassembler/dmresrc.c')
| -rw-r--r-- | source/components/disassembler/dmresrc.c | 23 |
1 files changed, 22 insertions, 1 deletions
diff --git a/source/components/disassembler/dmresrc.c b/source/components/disassembler/dmresrc.c index 1e37f8f3b6a6..ebec29442b8a 100644 --- a/source/components/disassembler/dmresrc.c +++ b/source/components/disassembler/dmresrc.c @@ -8,7 +8,7 @@ * * 1. Copyright Notice * - * Some or all of this work - Copyright (c) 1999 - 2025, Intel Corp. + * Some or all of this work - Copyright (c) 1999 - 2026, Intel Corp. * All rights reserved. * * 2. License @@ -536,10 +536,31 @@ AcpiDmIsResourceTemplate ( return (AE_TYPE); } + /* + * Check if this op was allocated from the extended parse object cache. + * Only extended ops (NAMED_OBJECT, DEFERRED, BYTELIST) have the + * Named.Data and Named.Length fields. Generic ops would overflow. + */ + if (NextOp->Common.Flags == ACPI_PARSEOP_GENERIC) + { + return (AE_TYPE); + } + Aml = NextOp->Named.Data; BufferLength = NextOp->Common.Value.Size; /* + * Validate BufferLength against Named.Length to prevent reading + * beyond the actual data. Named.Length is computed during parsing + * and represents the actual byte count, while Value.Size comes + * from the AML and can be manipulated by malformed AML. + */ + if (BufferLength > NextOp->Named.Length) + { + return (AE_TYPE); + } + + /* * Any buffer smaller than one byte cannot possibly be a resource * template. Two bytes could possibly be a "NULL" resource template * with a lone end tag descriptor (as generated via |