From c9f6a8605955926017cdbe2fa99a4b72fd0985a2 Mon Sep 17 00:00:00 2001 From: Michael Brown Date: Wed, 29 Jun 2016 15:13:35 +0100 Subject: [PATCH] [efi] Fix uninitialised data in HII IFR structures The HII IFR structures are allocated via realloc() rather than zalloc(), and so are not automatically zeroed. This results in the presence of uninitialised and invalid data, causing crashes elsewhere in the UEFI firmware. Fix by explicitly zeroing the newly allocated portion of any IFR structure in efi_ifr_op(). Debugged-by: Laszlo Ersek Debugged-by: Gary Lin Signed-off-by: Michael Brown --- src/interface/efi/efi_hii.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/interface/efi/efi_hii.c b/src/interface/efi/efi_hii.c index 0ea970e..506fc88 100644 --- a/src/interface/efi/efi_hii.c +++ b/src/interface/efi/efi_hii.c @@ -117,6 +117,7 @@ static void * efi_ifr_op ( struct efi_ifr_builder *ifr, unsigned int opcode, ifr->ops_len = new_ops_len; /* Fill in opcode header */ + memset ( op, 0, len ); op->OpCode = opcode; op->Length = len; -- 2.8.4