Returns a new fileobject containing a valid VBT */
| 731 | |
| 732 | /* Returns a new fileobject containing a valid VBT */ |
| 733 | static void parse_vbt(const struct fileobject *fo, |
| 734 | struct fileobject **vbt) |
| 735 | { |
| 736 | *vbt = NULL; |
| 737 | |
| 738 | if (fo->size < sizeof(struct vbt_header)) { |
| 739 | printerr("image is too small\n"); |
| 740 | return; |
| 741 | } |
| 742 | |
| 743 | const struct vbt_header *head = |
| 744 | (const struct vbt_header *)fo->data; |
| 745 | |
| 746 | if (memcmp(head->signature, "$VBT", 4) != 0) { |
| 747 | printerr("invalid VBT signature\n"); |
| 748 | return; |
| 749 | } |
| 750 | |
| 751 | if (!head->vbt_size || head->vbt_size > fo->size) { |
| 752 | printerr("invalid VBT size\n"); |
| 753 | return; |
| 754 | } |
| 755 | |
| 756 | if (!head->bdb_offset || |
| 757 | head->bdb_offset > fo->size - sizeof(struct bdb_header)) { |
| 758 | printerr("invalid BDB offset\n"); |
| 759 | return; |
| 760 | } |
| 761 | |
| 762 | if (!head->header_size || head->header_size > fo->size) { |
| 763 | printerr("invalid header size\n"); |
| 764 | return; |
| 765 | } |
| 766 | |
| 767 | const struct bdb_header *const bdb_head = |
| 768 | (const struct bdb_header *)((const u8 *)head + head->bdb_offset); |
| 769 | if (memcmp(bdb_head->signature, "BIOS_DATA_BLOCK ", 16) != 0) { |
| 770 | printerr("invalid BDB signature\n"); |
| 771 | return; |
| 772 | } |
| 773 | |
| 774 | if (!bdb_head->header_size || bdb_head->header_size > fo->size) { |
| 775 | printerr("invalid BDB header size\n"); |
| 776 | return; |
| 777 | } |
| 778 | |
| 779 | /* Duplicate fo as caller is owner and remalloc frees the object */ |
| 780 | struct fileobject *dupfo = malloc_fo_sub(fo, 0); |
| 781 | if (!dupfo) { |
| 782 | printerr("malloc failed\n"); |
| 783 | return; |
| 784 | } |
| 785 | |
| 786 | struct fileobject *newfo = remalloc_fo(dupfo, head->vbt_size); |
| 787 | if (!newfo) { |
| 788 | printerr("remalloc failed\n"); |
| 789 | free_fo(dupfo); |
| 790 | return; |
no test coverage detected