Ticket #4281: acpi_battery.cpp.patch

File acpi_battery.cpp.patch, 6.0 KB (added by phoudoin, 15 years ago)

Patch to add missing user_memcpy and some safety checks.

  • Data/projects/haiku/trunk/src/add-ons/kernel/drivers/power/acpi_battery/acpi_battery.cpp

     
    4949        &buffer);
    5050    if (status != B_OK)
    5151        goto exit;
    5252
    5353    object = (acpi_object_type*)buffer.pointer;
     54    if (object->object_type != ACPI_TYPE_PACKAGE ||
     55        object->data.package.count < 4) {
     56        status = B_ERROR;
     57        goto exit;
     58    }
    5459
    5560    pointer = object->data.package.objects;
    5661   
    57     batteryStatus->state = pointer->data.integer;
     62    batteryStatus->state = (pointer->object_type == ACPI_TYPE_INTEGER) ?
     63        pointer->data.integer : -1;
    5864    pointer++;
    59     batteryStatus->current_rate = pointer->data.integer;
     65    batteryStatus->current_rate = (pointer->object_type == ACPI_TYPE_INTEGER) ?
     66        pointer->data.integer : -1;
    6067    pointer++;
    61     batteryStatus->capacity = pointer->data.integer;
     68    batteryStatus->capacity = (pointer->object_type == ACPI_TYPE_INTEGER) ?
     69        pointer->data.integer : -1;
    6270    pointer++;
    63     batteryStatus->voltage = pointer->data.integer;
     71    batteryStatus->voltage = (pointer->object_type == ACPI_TYPE_INTEGER) ?
     72        pointer->data.integer : -1;
    6473
    6574exit:
    6675    free(buffer.pointer);
    6776    return status;
    6877}
    … …  
    8594    if (status != B_OK)
    8695        goto exit;
    8796
    8897    object = (acpi_object_type*)buffer.pointer;
    8998    if (object->object_type != ACPI_TYPE_PACKAGE ||
    90         object->data.package.count < 13)
     99        object->data.package.count < 13) {
     100        status = B_ERROR;
    91101        goto exit;
     102    }
    92103
    93104    pointer = object->data.package.objects;
    94105   
    95     batteryInfo->power_unit = pointer->data.integer;
     106    batteryInfo->power_unit = (pointer->object_type == ACPI_TYPE_INTEGER) ?
     107        pointer->data.integer : -1;
    96108    pointer ++;
    97     batteryInfo->design_capacity = pointer->data.integer;
     109    batteryInfo->design_capacity = (pointer->object_type == ACPI_TYPE_INTEGER) ?
     110        pointer->data.integer : -1;
    98111    pointer ++;
    99     batteryInfo->last_full_charge = pointer->data.integer;
     112    batteryInfo->last_full_charge = (pointer->object_type == ACPI_TYPE_INTEGER) ?
     113        pointer->data.integer : -1;
    100114    pointer ++;
    101     batteryInfo->technology = pointer->data.integer;
     115    batteryInfo->technology = (pointer->object_type == ACPI_TYPE_INTEGER) ?
     116        pointer->data.integer : -1;
    102117    pointer ++;
    103     batteryInfo->design_voltage = pointer->data.integer;
     118    batteryInfo->design_voltage = (pointer->object_type == ACPI_TYPE_INTEGER) ?
     119        pointer->data.integer : -1;
    104120    pointer ++;
    105     batteryInfo->design_capacity_warning = pointer->data.integer;
     121    batteryInfo->design_capacity_warning = (pointer->object_type == ACPI_TYPE_INTEGER) ?
     122        pointer->data.integer : -1;
    106123    pointer ++;
    107     batteryInfo->design_capacity_low = pointer->data.integer;
     124    batteryInfo->design_capacity_low = (pointer->object_type == ACPI_TYPE_INTEGER) ?
     125        pointer->data.integer : -1;
    108126    pointer ++;
    109     batteryInfo->capacity_granularity_1 = pointer->data.integer;
     127    batteryInfo->capacity_granularity_1 = (pointer->object_type == ACPI_TYPE_INTEGER) ?
     128        pointer->data.integer : -1;
    110129    pointer ++;
    111     batteryInfo->capacity_granularity_2 = pointer->data.integer;
     130    batteryInfo->capacity_granularity_2 = (pointer->object_type == ACPI_TYPE_INTEGER) ?
     131        pointer->data.integer : -1;
    112132    pointer ++;
    113     strcpy(batteryInfo->model_number, pointer->data.string.string);
     133    strlcpy(batteryInfo->model_number, sizeof(batteryInfo->model_number),
     134        (pointer->object_type == ACPI_TYPE_STRING) ? pointer->data.string.string : "");
    114135    pointer ++;
    115     strcpy(batteryInfo->serial_number, pointer->data.string.string);
     136    strlcpy(batteryInfo->serial_number, sizeof(batteryInfo->serial_number),
     137        (pointer->object_type == ACPI_TYPE_STRING) ? pointer->data.string.string : "");
    116138    pointer ++;
    117     strcpy(batteryInfo->type, pointer->data.string.string);
     139    strlcpy(batteryInfo->type, sizeof(batteryInfo->type),
     140        (pointer->object_type == ACPI_TYPE_STRING) ? pointer->data.string.string : "");
    118141    pointer ++;
    119     strcpy(batteryInfo->oem_info, pointer->data.string.string);
     142    strlcpy(batteryInfo->oem_info, sizeof(batteryInfo->oem_info),
     143        (pointer->object_type == ACPI_TYPE_STRING) ? pointer->data.string.string : "");
    120144   
    121145exit:
    122146    free(buffer.pointer);
    123147    return status;
    124148}
    … …  
    285309acpi_battery_control(void* _cookie, uint32 op, void* arg, size_t len)
    286310{
    287311    battery_device_cookie* device = (battery_device_cookie*)_cookie;
    288312    status_t err = B_ERROR;
    289313
    290     uint32* magicId;
    291     acpi_battery_info* batteryInfo;
    292     acpi_extended_battery_info* extBatteryInfo;
    293314    switch (op) {
    294         case IDENTIFY_DEVICE:
     315        case IDENTIFY_DEVICE: {
    295316            if (len < sizeof(uint32))
    296                 return B_IO_ERROR;
    297             magicId = (uint32*)arg;
    298             *magicId = kMagicACPIBatteryID;
    299             err = B_OK;
    300             break;
     317                return B_BAD_VALUE;
     318            uint32 magicId = kMagicACPIBatteryID;
     319            return user_memcpy(arg, &magicId, sizeof(magicId));
     320        }
    301321
    302         case GET_BATTERY_INFO:
     322        case GET_BATTERY_INFO: {
    303323            if (len < sizeof(acpi_battery_info))
    304                 return B_IO_ERROR;
    305             batteryInfo = (acpi_battery_info*)arg;
    306             err = ReadBatteryStatus(device->driver_cookie, batteryInfo);
    307             break;
     324                return B_BAD_VALUE;
     325               
     326            acpi_battery_info batteryInfo;
     327            err = ReadBatteryStatus(device->driver_cookie, &batteryInfo);
     328            if (err != B_OK)
     329                return err;     
     330            return user_memcpy(arg, &batteryInfo, sizeof(batteryInfo));
     331        }
    308332
    309         case GET_EXTENDED_BATTERY_INFO:
     333        case GET_EXTENDED_BATTERY_INFO: {
    310334            if (len < sizeof(acpi_extended_battery_info))
    311                 return B_IO_ERROR;
    312             extBatteryInfo = (acpi_extended_battery_info*)arg;
    313             err = ReadBatteryInfo(device->driver_cookie, extBatteryInfo);
    314             break;
     335                return B_BAD_VALUE;
     336               
     337            acpi_extended_battery_info extBatteryInfo;
     338            err = ReadBatteryInfo(device->driver_cookie, &extBatteryInfo);
     339            if (err != B_OK)
     340                return err;
     341            return user_memcpy(arg, &extBatteryInfo, sizeof(extBatteryInfo));
     342        }       
    315343       
    316344        case WATCH_BATTERY:
    317345            sBatteryCondition.Wait();
    318346            if (atomic_get(&(device->stop_watching))) {
    319347                atomic_set(&(device->stop_watching), 0);