From ab10dfe0d5101f54501fcbbcfe0267f9720bde1a Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 9 Nov 2022 15:08:40 +0100
Subject: [PATCH 1/3] acpi-fpdt: use our usual ret_xyz naming scheme

---
 src/shared/acpi-fpdt.c | 10 +++++-----
 src/shared/acpi-fpdt.h |  2 +-
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/shared/acpi-fpdt.c b/src/shared/acpi-fpdt.c
index cccea2f727..c499c7e067 100644
--- a/src/shared/acpi-fpdt.c
+++ b/src/shared/acpi-fpdt.c
@@ -61,7 +61,7 @@ struct acpi_fpdt_boot {
         uint64_t exit_services_exit;
 } _packed;
 
-int acpi_get_boot_usec(usec_t *loader_start, usec_t *loader_exit) {
+int acpi_get_boot_usec(usec_t *ret_loader_start, usec_t *ret_loader_exit) {
         _cleanup_free_ char *buf = NULL;
         struct acpi_table_header *tbl;
         size_t l = 0;
@@ -138,10 +138,10 @@ int acpi_get_boot_usec(usec_t *loader_start, usec_t *loader_exit) {
         if (brec.exit_services_exit > NSEC_PER_HOUR)
                 return -EINVAL;
 
-        if (loader_start)
-                *loader_start = brec.startup_start / 1000;
-        if (loader_exit)
-                *loader_exit = brec.exit_services_exit / 1000;
+        if (ret_loader_start)
+                *ret_loader_start = brec.startup_start / 1000;
+        if (ret_loader_exit)
+                *ret_loader_exit = brec.exit_services_exit / 1000;
 
         return 0;
 }
diff --git a/src/shared/acpi-fpdt.h b/src/shared/acpi-fpdt.h
index 9eef92bc35..56f8c9e077 100644
--- a/src/shared/acpi-fpdt.h
+++ b/src/shared/acpi-fpdt.h
@@ -3,4 +3,4 @@
 
 #include <time-util.h>
 
-int acpi_get_boot_usec(usec_t *loader_start, usec_t *loader_exit);
+int acpi_get_boot_usec(usec_t *ret_loader_start, usec_t *ret_loader_exit);

From 8cee3283f0ca98adccb3066fc4d19a6428958eaf Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 9 Nov 2022 15:09:08 +0100
Subject: [PATCH 2/3] acpi-fpdt: don't accidentally drop signedness of pread()
 return

---
 src/shared/acpi-fpdt.c | 15 ++++++++++-----
 1 file changed, 10 insertions(+), 5 deletions(-)

diff --git a/src/shared/acpi-fpdt.c b/src/shared/acpi-fpdt.c
index c499c7e067..0a91b38ab0 100644
--- a/src/shared/acpi-fpdt.c
+++ b/src/shared/acpi-fpdt.c
@@ -64,7 +64,8 @@ struct acpi_fpdt_boot {
 int acpi_get_boot_usec(usec_t *ret_loader_start, usec_t *ret_loader_exit) {
         _cleanup_free_ char *buf = NULL;
         struct acpi_table_header *tbl;
-        size_t l = 0;
+        size_t l;
+        ssize_t ll;
         struct acpi_fpdt_header *rec;
         int r;
         uint64_t ptr = 0;
@@ -109,8 +110,10 @@ int acpi_get_boot_usec(usec_t *ret_loader_start, usec_t *ret_loader_exit) {
         if (fd < 0)
                 return -errno;
 
-        l = pread(fd, &hbrec, sizeof(struct acpi_fpdt_boot_header), ptr);
-        if (l != sizeof(struct acpi_fpdt_boot_header))
+        ll = pread(fd, &hbrec, sizeof(struct acpi_fpdt_boot_header), ptr);
+        if (ll < 0)
+                return -errno;
+        if ((size_t) ll != sizeof(struct acpi_fpdt_boot_header))
                 return -EINVAL;
 
         if (memcmp(hbrec.signature, "FBPT", 4) != 0)
@@ -119,8 +122,10 @@ int acpi_get_boot_usec(usec_t *ret_loader_start, usec_t *ret_loader_exit) {
         if (hbrec.length < sizeof(struct acpi_fpdt_boot_header) + sizeof(struct acpi_fpdt_boot))
                 return -EINVAL;
 
-        l = pread(fd, &brec, sizeof(struct acpi_fpdt_boot), ptr + sizeof(struct acpi_fpdt_boot_header));
-        if (l != sizeof(struct acpi_fpdt_boot))
+        ll = pread(fd, &brec, sizeof(struct acpi_fpdt_boot), ptr + sizeof(struct acpi_fpdt_boot_header));
+        if (ll < 0)
+                return -errno;
+        if ((size_t) ll != sizeof(struct acpi_fpdt_boot))
                 return -EINVAL;
 
         if (brec.length != sizeof(struct acpi_fpdt_boot))

From 31edf44064fa3c0a83514f5633b0c2763102faaf Mon Sep 17 00:00:00 2001
From: Lennart Poettering <lennart@poettering.net>
Date: Wed, 9 Nov 2022 15:16:09 +0100
Subject: [PATCH 3/3] acpi-fpdt: make sure length/type fields are available in
 acpi_fpdt_header

some extra safety: make sure the two fields we care about are actually
properly present before the buffer is over.
---
 src/shared/acpi-fpdt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/shared/acpi-fpdt.c b/src/shared/acpi-fpdt.c
index 0a91b38ab0..668f6c3eee 100644
--- a/src/shared/acpi-fpdt.c
+++ b/src/shared/acpi-fpdt.c
@@ -89,7 +89,7 @@ int acpi_get_boot_usec(usec_t *ret_loader_start, usec_t *ret_loader_exit) {
 
         /* find Firmware Basic Boot Performance Pointer Record */
         for (rec = (struct acpi_fpdt_header *)(buf + sizeof(struct acpi_table_header));
-             (char *)rec < buf + l;
+             (char *)rec + offsetof(struct acpi_fpdt_header, revision) <= buf + l;
              rec = (struct acpi_fpdt_header *)((char *)rec + rec->length)) {
                 if (rec->length <= 0)
                         break;