efi_loader: NULL dereference in efi_convert_pointer
authorHeinrich Schuchardt <xypron.glpk@gmx.de>
Tue, 7 Jul 2020 01:10:12 +0000 (03:10 +0200)
committerHeinrich Schuchardt <xypron.glpk@gmx.de>
Sat, 11 Jul 2020 21:14:16 +0000 (23:14 +0200)
Avoid a possible NULL pointer dereference in efi_convert_pointer().

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
lib/efi_loader/efi_runtime.c

index c0bd99b..121e2f6 100644 (file)
@@ -499,7 +499,7 @@ static __efi_runtime efi_status_t EFIAPI efi_convert_pointer_runtime(
 static __efi_runtime efi_status_t EFIAPI efi_convert_pointer(
                        efi_uintn_t debug_disposition, void **address)
 {
-       efi_physical_addr_t addr = (uintptr_t)*address;
+       efi_physical_addr_t addr;
        efi_uintn_t i;
        efi_status_t ret = EFI_NOT_FOUND;
 
@@ -515,6 +515,7 @@ static __efi_runtime efi_status_t EFIAPI efi_convert_pointer(
                goto out;
        }
 
+       addr = (uintptr_t)*address;
        for (i = 0; i < efi_descriptor_count; i++) {
                struct efi_mem_desc *map = (void *)efi_virtmap +
                                           (efi_descriptor_size * i);