diff options
| author | Michael Brown | 2016-06-29 16:13:35 +0200 |
|---|---|---|
| committer | Michael Brown | 2016-06-29 16:17:12 +0200 |
| commit | c9f6a8605955926017cdbe2fa99a4b72fd0985a2 (patch) | |
| tree | b706b36a580d10726a9124b0b5df4898d9258479 /src/interface | |
| parent | [thunderx] Fix compilation with older versions of gcc (diff) | |
| download | ipxe-c9f6a8605955926017cdbe2fa99a4b72fd0985a2.tar.gz ipxe-c9f6a8605955926017cdbe2fa99a4b72fd0985a2.tar.xz ipxe-c9f6a8605955926017cdbe2fa99a4b72fd0985a2.zip | |
[efi] Fix uninitialised data in HII IFR structures
The HII IFR structures are allocated via realloc() rather than
zalloc(), and so are not automatically zeroed. This results in the
presence of uninitialised and invalid data, causing crashes elsewhere
in the UEFI firmware.
Fix by explicitly zeroing the newly allocated portion of any IFR
structure in efi_ifr_op().
Debugged-by: Laszlo Ersek <lersek@redhat.com>
Debugged-by: Gary Lin <glin@suse.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
Diffstat (limited to 'src/interface')
| -rw-r--r-- | src/interface/efi/efi_hii.c | 1 |
1 files changed, 1 insertions, 0 deletions
diff --git a/src/interface/efi/efi_hii.c b/src/interface/efi/efi_hii.c index 0ea970e6..506fc886 100644 --- a/src/interface/efi/efi_hii.c +++ b/src/interface/efi/efi_hii.c @@ -117,6 +117,7 @@ static void * efi_ifr_op ( struct efi_ifr_builder *ifr, unsigned int opcode, ifr->ops_len = new_ops_len; /* Fill in opcode header */ + memset ( op, 0, len ); op->OpCode = opcode; op->Length = len; |