[cgutman] 63344: [ACPI] - Fix a buffer overrun that caused a BSOD with ACPI enabled on Hyper-V - Dynamically allocate the hardware ID buffer to prevent another HID overrun - Switched sprintf to snp...

Author: cgutman
Date: Sun May 18 05:52:09 2014
New Revision: 63344

URL: http://svn.reactos.org/svn/reactos?rev=63344&view=rev
Log:
[ACPI]
- Fix a buffer overrun that caused a BSOD with ACPI enabled on Hyper-V
- Dynamically allocate the hardware ID buffer to prevent another HID overrun
- Switched sprintf to snprintf to prevent this from happening to another ID

Modified:
    trunk/reactos/drivers/bus/acpi/busmgr/bus.c
    trunk/reactos/drivers/bus/acpi/include/acpi_bus.h

Modified: trunk/reactos/drivers/bus/acpi/busmgr/bus.c
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/bus/acpi/busmgr/bu…
==============================================================================
--- trunk/reactos/drivers/bus/acpi/busmgr/bus.c	[iso-8859-1] (original)
+++ trunk/reactos/drivers/bus/acpi/busmgr/bus.c	[iso-8859-1] Sun May 18 05:52:09 2014
@@ -1142,7 +1142,7 @@
 	char			*uid = NULL;
 	ACPI_PNP_DEVICE_ID_LIST *cid_list = NULL;
 	int			i = 0;
-	char			static_uid_buffer[5];
+	acpi_unique_id		static_uid_buffer;
 
 	if (!child)
 		return_VALUE(AE_BAD_PARAMETER);
@@ -1165,15 +1165,15 @@
 	 */
 	switch (type) {
 	case ACPI_BUS_TYPE_SYSTEM:
-		sprintf(device->pnp.bus_id, "%s", "ACPI");
+		snprintf(device->pnp.bus_id, sizeof(device->pnp.bus_id), "%s",
"ACPI");
 		break;
 	case ACPI_BUS_TYPE_POWER_BUTTONF:
 	case ACPI_BUS_TYPE_POWER_BUTTON:
-		sprintf(device->pnp.bus_id, "%s", "PWRF");
+		snprintf(device->pnp.bus_id, sizeof(device->pnp.bus_id), "%s",
"PWRF");
 		break;
 	case ACPI_BUS_TYPE_SLEEP_BUTTONF:
 	case ACPI_BUS_TYPE_SLEEP_BUTTON:
-		sprintf(device->pnp.bus_id, "%s", "SLPF");
+		snprintf(device->pnp.bus_id, sizeof(device->pnp.bus_id), "%s",
"SLPF");
 		break;
 	default:
 		buffer.Length = sizeof(bus_id);
@@ -1188,7 +1188,7 @@
 			else
 				break;
 		}
-		sprintf(device->pnp.bus_id, "%s", bus_id);
+		snprintf(device->pnp.bus_id, sizeof(device->pnp.bus_id), "%s",
bus_id);
 		buffer.Pointer = NULL;
 
         /* HACK: Skip HPET */
@@ -1277,12 +1277,12 @@
 	case ACPI_BUS_TYPE_POWER:
 		hid = ACPI_POWER_HID;
         uid = static_uid_buffer;
-		sprintf(uid, "%d", (PowerDeviceCount++));
+		snprintf(uid, sizeof(static_uid_buffer), "%d", (PowerDeviceCount++));
 		break;
 	case ACPI_BUS_TYPE_PROCESSOR:
 		hid = ACPI_PROCESSOR_HID;
 		uid = static_uid_buffer;
-		sprintf(uid, "_%d", (ProcessorCount++));
+		snprintf(uid, sizeof(static_uid_buffer), "_%d", (ProcessorCount++));
 		break;
 	case ACPI_BUS_TYPE_SYSTEM:
 		hid = ACPI_SYSTEM_HID;
@@ -1290,27 +1290,27 @@
 	case ACPI_BUS_TYPE_THERMAL:
 		hid = ACPI_THERMAL_HID;
         uid = static_uid_buffer;
-		sprintf(uid, "%d", (ThermalZoneCount++));
+		snprintf(uid, sizeof(static_uid_buffer), "%d", (ThermalZoneCount++));
 		break;
 	case ACPI_BUS_TYPE_POWER_BUTTON:
 		hid = ACPI_BUTTON_HID_POWER;
         uid = static_uid_buffer;
-		sprintf(uid, "%d", (PowerButtonCount++));
+		snprintf(uid, sizeof(static_uid_buffer), "%d", (PowerButtonCount++));
 		break;
 	case ACPI_BUS_TYPE_POWER_BUTTONF:
 		hid = ACPI_BUTTON_HID_POWERF;
         uid = static_uid_buffer;
-		sprintf(uid, "%d", (FixedPowerButtonCount++));
+		snprintf(uid, sizeof(static_uid_buffer), "%d", (FixedPowerButtonCount++));
 		break;
 	case ACPI_BUS_TYPE_SLEEP_BUTTON:
 		hid = ACPI_BUTTON_HID_SLEEP;
         uid = static_uid_buffer;
-		sprintf(uid, "%d", (SleepButtonCount++));
+		snprintf(uid, sizeof(static_uid_buffer), "%d", (SleepButtonCount++));
 		break;
 	case ACPI_BUS_TYPE_SLEEP_BUTTONF:
 		hid = ACPI_BUTTON_HID_SLEEPF;
         uid = static_uid_buffer;
-		sprintf(uid, "%d", (FixedSleepButtonCount++));
+		snprintf(uid, sizeof(static_uid_buffer), "%d", (FixedSleepButtonCount++));
 		break;
 	}
 
@@ -1321,16 +1321,19 @@
 	 */
 	if (((ACPI_HANDLE)parent == ACPI_ROOT_OBJECT) && (type == ACPI_BUS_TYPE_DEVICE))
{
 		hid = ACPI_BUS_HID;
-		sprintf(device->pnp.device_name, "%s", ACPI_BUS_DEVICE_NAME);
-		sprintf(device->pnp.device_class, "%s", ACPI_BUS_CLASS);
+		snprintf(device->pnp.device_name, sizeof(device->pnp.device_name),
"%s", ACPI_BUS_DEVICE_NAME);
+		snprintf(device->pnp.device_class, sizeof(device->pnp.device_class),
"%s", ACPI_BUS_CLASS);
 	}
 
 	if (hid) {
-		sprintf(device->pnp.hardware_id, "%s", hid);
-		device->flags.hardware_id = 1;
+        device->pnp.hardware_id = ExAllocatePoolWithTag(NonPagedPool, strlen(hid) + 1,
'IPCA');
+        if (device->pnp.hardware_id) {
+            snprintf(device->pnp.hardware_id, strlen(hid) + 1, "%s", hid);
+            device->flags.hardware_id = 1;
+        }
 	}
 	if (uid) {
-		sprintf(device->pnp.unique_id, "%s", uid);
+		snprintf(device->pnp.unique_id, sizeof(device->pnp.unique_id), "%s",
uid);
 		device->flags.unique_id = 1;
 	}
 
@@ -1434,6 +1437,9 @@
 		if (device->pnp.cid_list) {
 			ExFreePoolWithTag(device->pnp.cid_list, 'IPCA');
 		}
+        if (device->pnp.hardware_id) {
+            ExFreePoolWithTag(device->pnp.hardware_id, 'IPCA');
+        }
 		ExFreePoolWithTag(device, 'IPCA');
 		return_VALUE(result);
 	}
@@ -1454,8 +1460,11 @@
 
 	acpi_device_unregister(device);
 
-	if (device && device->pnp.cid_list)
+	if (device->pnp.cid_list)
 		ExFreePoolWithTag(device->pnp.cid_list, 'IPCA');
+
+    if (device->pnp.hardware_id)
+        ExFreePoolWithTag(device->pnp.hardware_id, 'IPCA');
 
 	if (device)
 		ExFreePoolWithTag(device, 'IPCA');

Modified: trunk/reactos/drivers/bus/acpi/include/acpi_bus.h
URL:
http://svn.reactos.org/svn/reactos/trunk/reactos/drivers/bus/acpi/include/a…
==============================================================================
--- trunk/reactos/drivers/bus/acpi/include/acpi_bus.h	[iso-8859-1] (original)
+++ trunk/reactos/drivers/bus/acpi/include/acpi_bus.h	[iso-8859-1] Sun May 18 05:52:09
2014
@@ -164,10 +164,10 @@
 
 /* Plug and Play */
 
-typedef char			acpi_bus_id[20];
+typedef char			acpi_bus_id[8];
 typedef unsigned long		acpi_bus_address;
-typedef char			acpi_hardware_id[20];
-typedef char			acpi_unique_id[20];
+typedef char			*acpi_hardware_id;
+typedef char			acpi_unique_id[9];
 typedef char			acpi_device_name[40];
 typedef char			acpi_device_class[20];