> Currently, dsm_label_utf16s_to_utf8s() passes the ACPI buffer
> length to utf16s_to_utf8s() unchanged. The Device Name _DSM may
> return the device name as a buffer holding a UTF-16 string, and
> the ACPI length counts bytes while the converter counts wchar_t
> elements. The converter therefore receives a count twice the
> number of code units the buffer holds, and that count is its only
> bound on the input.
>
> A NUL code unit ends the conversion early, so a name that carries
> one is converted correctly and the error stays hidden. ACPICA
> zeroes the entire result allocation, and the padding placed after
> the buffer supplies that NUL for most lengths. Lengths that leave
> no padding, or a single byte of it, do not, and the conversion
> then runs up to its own length in bytes past the end of the
> allocation. The bytes beyond the allocation are decoded into the
> "label" attribute, which is world readable.
>
> Thus, divide the buffer length by the size of wchar_t so that the
> converter receives a count of code units. The division truncates,
> so the converter is never told to read more bytes than the buffer
> holds, including for an odd length.
>
> Reaching the out of bounds read needs firmware that returns the
> name as a buffer and omits the terminator.
>
> Fixes: 6058989bad05 ("PCI: Export ACPI _DSM provided firmware instance number and string name to sysfs")
> Cc: [email protected]
> Signed-off-by: Krzysztof Wilczyński <[email protected]>
Sashiko has reviewed this patch and found no issues. It looks great!
--
Sashiko AI review · https://sashiko.dev/#/patchset/[email protected]?part=4
lmpx.com only provides a reader for public news (NNTP) servers. It is not
affiliated with the servers or forums shown here and is not responsible for
the content of articles, which is written by their respective authors.