diff options
| author | Dov Murik | 2022-02-22 08:19:06 +0100 |
|---|---|---|
| committer | Gerd Hoffmann | 2022-03-04 11:24:52 +0100 |
| commit | bfc8c14459dae16b525cd024600d20f022b6ee55 (patch) | |
| tree | bdb3e076a17b2d59a3901cb966b503672cdcca36 /hw | |
| parent | hw/i386: Improve bounds checking in OVMF table parsing (diff) | |
| download | qemu-bfc8c14459dae16b525cd024600d20f022b6ee55.tar.gz qemu-bfc8c14459dae16b525cd024600d20f022b6ee55.tar.xz qemu-bfc8c14459dae16b525cd024600d20f022b6ee55.zip | |
hw/i386: Replace magic number with field length calculation
Replce the literal magic number 48 with length calculation (32 bytes at
the end of the firmware after the table footer + 16 bytes of the OVMF
table footer GUID).
No functional change intended.
Signed-off-by: Dov Murik <dovmurik@linux.ibm.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20220222071906.2632426-3-dovmurik@linux.ibm.com>
Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
Diffstat (limited to 'hw')
| -rw-r--r-- | hw/i386/pc_sysfw_ovmf.c | 9 |
1 files changed, 6 insertions, 3 deletions
diff --git a/hw/i386/pc_sysfw_ovmf.c b/hw/i386/pc_sysfw_ovmf.c index df15c9737b..07a4c267fa 100644 --- a/hw/i386/pc_sysfw_ovmf.c +++ b/hw/i386/pc_sysfw_ovmf.c @@ -30,6 +30,8 @@ #define OVMF_TABLE_FOOTER_GUID "96b582de-1fb2-45f7-baea-a366c55a082d" +static const int bytes_after_table_footer = 32; + static bool ovmf_flash_parsed; static uint8_t *ovmf_table; static int ovmf_table_len; @@ -53,12 +55,13 @@ void pc_system_parse_ovmf_flash(uint8_t *flash_ptr, size_t flash_size) /* * if this is OVMF there will be a table footer - * guid 48 bytes before the end of the flash file. If it's - * not found, silently abort the flash parsing. + * guid 48 bytes before the end of the flash file + * (= 32 bytes after the table + 16 bytes the GUID itself). + * If it's not found, silently abort the flash parsing. */ qemu_uuid_parse(OVMF_TABLE_FOOTER_GUID, &guid); guid = qemu_uuid_bswap(guid); /* guids are LE */ - ptr = flash_ptr + flash_size - 48; + ptr = flash_ptr + flash_size - (bytes_after_table_footer + sizeof(guid)); if (!qemu_uuid_is_equal((QemuUUID *)ptr, &guid)) { return; } |