From 1b30c2b9e5ee7d3e305a28a92805152d5cbfc9cb Mon Sep 17 00:00:00 2001 From: Jan Setje-Eilers Date: Mon, 26 Jul 2021 20:24:13 -0700 Subject: [PATCH 27/35] fallback: find_boot_option() needs to return the index for the boot entry in optnum The CopyMem() calls in add_to_boot_list() expect that find_boot_option() returned an index to the matching entry in the BootOrder array. The previous code returned the numerical portion of the boot entry label, which in some cases resulted in -1 * sizeof(CHAR16) being passed to CopyMem() which would in turn corrupt the running firmware resulting in an exception and a failure to boot or reset. --- fallback.c | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/fallback.c b/fallback.c index 8d89917a..87fc3c80 100644 --- a/fallback.c +++ b/fallback.c @@ -462,10 +462,15 @@ find_boot_option(EFI_DEVICE_PATH *dp, EFI_DEVICE_PATH *fulldp, first_new_option_size = StrLen(arguments) * sizeof (CHAR16); } - *optnum = xtoi(varname + 4); - FreePool(candidate); - FreePool(data); - return EFI_SUCCESS; + /* find the index for the matching entry in BootOrder */ + UINT16 bootnum = xtoi(varname + 4); + for (*optnum = 0; *optnum < nbootorder; (*optnum)++) { + if (bootorder[*optnum] == bootnum) { + FreePool(candidate); + FreePool(data); + return EFI_SUCCESS; + } + } } FreePool(candidate); FreePool(data); -- 2.32.0