Skip to content

Commit

Permalink
[efi] Fix uninitialised data in HII IFR structures
Browse files Browse the repository at this point in the history
The HII IFR structures are allocated via realloc() rather than
zalloc(), and so are not automatically zeroed.  This results in the
presence of uninitialised and invalid data, causing crashes elsewhere
in the UEFI firmware.

Fix by explicitly zeroing the newly allocated portion of any IFR
structure in efi_ifr_op().

Debugged-by: Laszlo Ersek <lersek@redhat.com>
Debugged-by: Gary Lin <glin@suse.com>
Signed-off-by: Michael Brown <mcb30@ipxe.org>
  • Loading branch information
mcb30 committed Jun 29, 2016
1 parent 0418631 commit c9f6a86
Showing 1 changed file with 1 addition and 0 deletions.
1 change: 1 addition & 0 deletions src/interface/efi/efi_hii.c
Expand Up @@ -117,6 +117,7 @@ static void * efi_ifr_op ( struct efi_ifr_builder *ifr, unsigned int opcode,
ifr->ops_len = new_ops_len;

/* Fill in opcode header */
memset ( op, 0, len );
op->OpCode = opcode;
op->Length = len;

Expand Down

0 comments on commit c9f6a86

Please sign in to comment.