hw/i386: Improve bounds checking in OVMF table parsing
authorDov Murik <dovmurik@linux.ibm.com>
Tue, 22 Feb 2022 07:19:05 +0000 (07:19 +0000)
committerMichael S. Tsirkin <mst@redhat.com>
Sun, 6 Mar 2022 10:08:23 +0000 (05:08 -0500)
commite5aaeac3554599ad5ca3c8ace38ad5bcd7ae6ff1
treeffb5915991ec1f706820101b1175c99f2e0b1e4b
parentb8ffd7d6713fb2703f4b09cea3e62d1c61767107
hw/i386: Improve bounds checking in OVMF table parsing

When pc_system_parse_ovmf_flash() parses the optional GUIDed table in
the end of the OVMF flash memory area, the table length field is checked
for sizes that are too small, but doesn't error on sizes that are too
big (bigger than the flash content itself).

Add a check for maximal size of the OVMF table, and add an error report
in case the size is invalid.  In such a case, an error like this will be
displayed during launch:

    qemu-system-x86_64: OVMF table has invalid size 4047

and the table parsing is skipped.

Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
Message-Id: <20220222071906.2632426-2-dovmurik@linux.ibm.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
hw/i386/pc_sysfw_ovmf.c