summaryrefslogtreecommitdiff
path: root/src/drivers/intel
diff options
context:
space:
mode:
Diffstat (limited to 'src/drivers/intel')
-rw-r--r--src/drivers/intel/fsp2_0/include/fsp/info_header.h5
-rw-r--r--src/drivers/intel/fsp2_0/util.c25
2 files changed, 22 insertions, 8 deletions
diff --git a/src/drivers/intel/fsp2_0/include/fsp/info_header.h b/src/drivers/intel/fsp2_0/include/fsp/info_header.h
index e08828a1a7..5b6318cb7c 100644
--- a/src/drivers/intel/fsp2_0/include/fsp/info_header.h
+++ b/src/drivers/intel/fsp2_0/include/fsp/info_header.h
@@ -6,11 +6,6 @@
#include <types.h>
#define FSP_HDR_OFFSET 0x94
-#if CONFIG(PLATFORM_USES_FSP2_2)
-#define FSP_HDR_LEN 0x4c
-#else
-#define FSP_HDR_LEN 0x48
-#endif
#define FSP_HDR_SIGNATURE "FSPH"
#define FSP_HDR_ATTRIB_FSPT 1
#define FSP_HDR_ATTRIB_FSPM 2
diff --git a/src/drivers/intel/fsp2_0/util.c b/src/drivers/intel/fsp2_0/util.c
index e9809e1f01..5045d29448 100644
--- a/src/drivers/intel/fsp2_0/util.c
+++ b/src/drivers/intel/fsp2_0/util.c
@@ -10,16 +10,35 @@
#include <fsp/util.h>
#include <string.h>
#include <types.h>
+#include <assert.h>
+
+static uint32_t fsp_hdr_get_expected_min_length(void)
+{
+ if (CONFIG(PLATFORM_USES_FSP2_2))
+ return 76;
+ else if (CONFIG(PLATFORM_USES_FSP2_1))
+ return 72;
+ else if (CONFIG(PLATFORM_USES_FSP2_0))
+ return 72;
+ else
+ return dead_code_t(uint32_t);
+}
static bool looks_like_fsp_header(const uint8_t *raw_hdr)
{
+ uint32_t fsp_header_length = read32(raw_hdr + 4);
+
if (memcmp(raw_hdr, FSP_HDR_SIGNATURE, 4)) {
printk(BIOS_ALERT, "Did not find a valid FSP signature\n");
return false;
}
- if (read32(raw_hdr + 4) != FSP_HDR_LEN) {
- printk(BIOS_ALERT, "FSP header has invalid length\n");
+ /* It is possible to build FSP with any version of EDK2 which could have introduced new
+ fields in FSP_INFO_HEADER. The new fields will be ignored based on the reported FSP
+ version. This check ensures that the reported header length is at least what the
+ reported FSP version requires so that we do not access any out-of-bound bytes. */
+ if (fsp_header_length < fsp_hdr_get_expected_min_length()) {
+ printk(BIOS_ALERT, "FSP header has invalid length: %d\n", fsp_header_length);
return false;
}
@@ -59,7 +78,7 @@ enum cb_err fsp_validate_component(struct fsp_header *hdr, void *fsp_file, size_
{
void *raw_hdr = fsp_file + FSP_HDR_OFFSET;
- if (file_size < FSP_HDR_OFFSET + FSP_HDR_LEN) {
+ if (file_size < FSP_HDR_OFFSET + fsp_hdr_get_expected_min_length()) {
printk(BIOS_CRIT, "FSP blob too small.\n");
return CB_ERR;
}