From mboxrd@z Thu Jan  1 00:00:00 1970
From: Ilias Apalodimas <ilias.apalodimas@linaro.org>
Date: Sun, 14 Mar 2021 09:32:00 +0200
Subject: [PATCH 2/6] efi_loader: Add device path related functions for
 initrd via Boot####
In-Reply-To: <fe840c81-b453-5118-ad69-a9e44e2b52d9@gmx.de>
References: <20210313214738.3257922-1-ilias.apalodimas@linaro.org>
 <20210313214738.3257922-3-ilias.apalodimas@linaro.org>
 <fe840c81-b453-5118-ad69-a9e44e2b52d9@gmx.de>
Message-ID: <YE278DOFJE8NM2up@enceladus>
List-Id: <u-boot.lists.denx.de>
MIME-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
To: u-boot@lists.denx.de

On Sun, Mar 14, 2021 at 08:19:49AM +0100, Heinrich Schuchardt wrote:
> > + *               Caller must free the returned value

[...]

> > + */
> > +struct
> > +efi_device_path *efi_dp_from_lo(struct efi_load_option *lo,
> > +				efi_uintn_t *size, efi_guid_t guid)
> > +{
> > +	struct efi_device_path *fp = lo->file_path;
> > +	struct efi_device_path_vendor *vendor;
> > +	int lo_len = lo->file_path_length;
> > +
> > +	for (; lo_len >=  sizeof(struct efi_device_path);
> > +	     lo_len -= fp->length, fp = (void *)fp + fp->length) {
> > +		if (fp->type != DEVICE_PATH_TYPE_MEDIA_DEVICE ||
> > +		    fp->sub_type != DEVICE_PATH_SUB_TYPE_VENDOR_PATH)
> > +			continue;
> 
> The device path is provided by the user and may be constructed incorrectly.
> 
> lo_len might be negative here. Or the remaining device path might not
> fit into lo_len.
> 
> Function efi_dp_check_length() can be used to check the size but it
> currently accepts only positive values of maxlen. Maybe we should change
> the type of maxlen to ssize() in that function.
> 

Yea, I forgot to fix this one. 

Regards
/Ilias
> Best regards
> 
> Heinrich
> 
> > +
> > +		vendor = (struct efi_device_path_vendor *)fp;
> > +		if (!guidcmp(&vendor->guid, &guid))
> > +			return efi_dp_dup(fp);
> > +	}
> > +	log_debug("VenMedia(%pUl) not found in %ls\n", &guid, lo->label);
> > +
> > +	return NULL;
> > +}
> > 
>