svn commit: r320736 - head/usr.sbin/acpi/acpidump

[Ed Maste]

Author: emaste
Date: Thu Jul  6 14:35:47 2017
New Revision: 320736
URL: https://svnweb.freebsd.org/changeset/base/320736

Log:
  acpidump: warn and exit loop on invalid subtable length
  
  Submitted by:	Guangyuan Yang <yzgyyang at outlook.com>
  Sponsored by:	The FreeBSD Foundation

Modified:
  head/usr.sbin/acpi/acpidump/acpi.c

Modified: head/usr.sbin/acpi/acpidump/acpi.c
==============================================================================
--- head/usr.sbin/acpi/acpidump/acpi.c	Thu Jul  6 13:27:01 2017	(r320735)
+++ head/usr.sbin/acpi/acpidump/acpi.c	Thu Jul  6 14:35:47 2017	(r320736)
@@ -270,6 +270,10 @@ acpi_walk_subtables(ACPI_TABLE_HEADER *table, void *fi
 	end = (char *)table + table->Length;
 	while ((char *)subtable < end) {
 		printf("\n");
+		if (subtable->Length < sizeof(ACPI_SUBTABLE_HEADER)) {
+			warnx("invalid subtable length %u", subtable->Length);
+			return;
+		}
 		action(subtable);
 		subtable = (ACPI_SUBTABLE_HEADER *)((char *)subtable +
 		    subtable->Length);