[PATCH v1 13/30] ACPICA: tables: Fix heap-buffer-overflow in AcpiTbFindTable

[Pawel Chmielewski]

From: ikaros <void0red@xxxxxxxxx>

The OEM ID and OEM Table ID string operands passed to AcpiTbFindTable
can be shorter than ACPI_OEM_ID_SIZE (6) and ACPI_OEM_TABLE_ID_SIZE (8).
The unconditional memcpy reads past the string allocation when the input
is too short. Validate string length before memcpy and copy only what
is available, relying on the prior memset to zero-pad the remainder.

Link: https://github.com/acpica/acpica/commit/dfb5b18ef458
Closes: https://github.com/open-acpica/acpica/issues/1179
Signed-off-by: ikaros <void0red@xxxxxxxxx>
Signed-off-by: Pawel Chmielewski <pawel.chmielewski@xxxxxxxxx>
---
 drivers/acpi/acpica/tbfind.c | 16 ++++++++++++++--
 1 file changed, 14 insertions(+), 2 deletions(-)

diff --git a/drivers/acpi/acpica/tbfind.c b/drivers/acpi/acpica/tbfind.c
index 60a772c87f42..f36a9b34058f 100644
--- a/drivers/acpi/acpica/tbfind.c
+++ b/drivers/acpi/acpica/tbfind.c
@@ -57,8 +57,20 @@ acpi_tb_find_table(char *signature,
 
 	memset(&header, 0, sizeof(struct acpi_table_header));
 	ACPI_COPY_NAMESEG(header.signature, signature);
-	memcpy(header.oem_id, oem_id, ACPI_OEM_ID_SIZE);
-	memcpy(header.oem_table_id, oem_table_id, ACPI_OEM_TABLE_ID_SIZE);
+	if (strlen(oem_id) >= ACPI_OEM_ID_SIZE) {
+		memcpy(header.oem_id, oem_id, ACPI_OEM_ID_SIZE);
+	} else {
+		memcpy(header.oem_id, oem_id, strlen(oem_id));
+		/* Remainder is already zeroed by memset above */
+	}
+
+	if (strlen(oem_table_id) >= ACPI_OEM_TABLE_ID_SIZE) {
+		memcpy(header.oem_table_id, oem_table_id,
+		       ACPI_OEM_TABLE_ID_SIZE);
+	} else {
+		memcpy(header.oem_table_id, oem_table_id, strlen(oem_table_id));
+		/* Remainder is already zeroed by memset above */
+	}
 
 	/* Search for the table */
 
-- 
2.50.1