efi-boot-shim/errlog.c
Peter Jones 344a8364cb VLogError(): Avoid NULL pointer dereferences in (V)Sprint calls
VLogError() calculates the size of format strings by using calls to
SPrint and VSPrint with a StrSize of 0 and NULL for an output buffer.
Unfortunately, this is an incorrect usage of (V)Sprint. A StrSize
of "0" is special-cased to mean "there is no limit". So, we end up
writing our string to address 0x0. This was discovered because it
causes a crash on ARM where, unlike x86, it does not necessarily
have memory mapped at 0x0.

Avoid the (V)Sprint calls altogether by using (V)PoolPrint, which
handles the size calculation and allocation for us.

Signed-off-by: Peter Jones <pjones@redhat.com>
Fixes: 25f6fd08cd ("try to show errors more usefully.")
[dannf: commit message ]
Signed-off-by: dann frazier <dann.frazier@canonical.com>
Upstream-commit-id: 20e731f423a
2020-07-23 20:52:12 -04:00

78 lines
1.3 KiB
C

/*
* errlog.c
* Copyright 2017 Peter Jones <pjones@redhat.com>
*
* Distributed under terms of the GPLv3 license.
*/
#include "shim.h"
static CHAR16 **errs = NULL;
static UINTN nerrs = 0;
EFI_STATUS
VLogError(const char *file, int line, const char *func, CHAR16 *fmt, va_list args)
{
va_list args2;
CHAR16 **newerrs;
newerrs = ReallocatePool(errs, (nerrs + 1) * sizeof(*errs),
(nerrs + 3) * sizeof(*errs));
if (!newerrs)
return EFI_OUT_OF_RESOURCES;
newerrs[nerrs] = PoolPrint(L"%a:%d %a() ", file, line, func);
if (!newerrs[nerrs])
return EFI_OUT_OF_RESOURCES;
va_copy(args2, args);
newerrs[nerrs+1] = VPoolPrint(fmt, args2);
if (!newerrs[nerrs+1])
return EFI_OUT_OF_RESOURCES;
va_end(args2);
nerrs += 2;
newerrs[nerrs] = NULL;
errs = newerrs;
return EFI_SUCCESS;
}
EFI_STATUS
LogError_(const char *file, int line, const char *func, CHAR16 *fmt, ...)
{
va_list args;
EFI_STATUS efi_status;
va_start(args, fmt);
efi_status = VLogError(file, line, func, fmt, args);
va_end(args);
return efi_status;
}
VOID
PrintErrors(VOID)
{
UINTN i;
if (!verbose)
return;
for (i = 0; i < nerrs; i++)
console_print(L"%s", errs[i]);
}
VOID
ClearErrors(VOID)
{
UINTN i;
for (i = 0; i < nerrs; i++)
FreePool(errs[i]);
FreePool(errs);
nerrs = 0;
errs = NULL;
}
// vim:fenc=utf-8:tw=75