svn commit: r339800 - head/stand/efi/loader

[Warner Losh]

Author: imp
Date: Fri Oct 26 23:08:22 2018
New Revision: 339800
URL: https://svnweb.freebsd.org/changeset/base/339800

Log:
  Ensure we have a full EFI_DEVICE_PATH header before we try to look at
  its length. Some BIOSes pad the length of the device path to an even
  amount. When we had a device path that was somehow an odd length, we'd
  wind up having 1 byte left that we were bogusly interpreting as a full
  device path. We'd then dereference 2 bytes into that to get a length
  of the node, which had undefined (and quite undesired) effects.
  
  Sponsored by: Netflix, Inc
  MFC After: 3 days

Modified:
  head/stand/efi/loader/main.c

Modified: head/stand/efi/loader/main.c
==============================================================================
--- head/stand/efi/loader/main.c	Fri Oct 26 22:49:36 2018	(r339799)
+++ head/stand/efi/loader/main.c	Fri Oct 26 23:08:22 2018	(r339800)
@@ -349,7 +349,7 @@ match_boot_info(EFI_LOADED_IMAGE *img __unused, char *
 	edp = (EFI_DEVICE_PATH *)(walker + fplen);
 	if ((char *)edp > ep)
 		return NOT_SPECIFIC;
-	while (dp < edp) {
+	while (dp < edp && (size_t)(edp - dp) > sizeof(EFI_DEVICE_PATH)) {
 		text = efi_devpath_name(dp);
 		if (text != NULL) {
 			printf("   BootInfo Path: %S\n", text);