DynamicTablesPkg/AcpiSpcrLib: Fix NameSpaceString buffer overflowHEADmaster

`EFI_ACPI_SERIAL_PORT_CONSOLE_REDIRECTION_TABLE_4` ends with the
flexible array member `NameSpaceString[]`, so the static `AcpiSpcr`
template provides no storage for the namespace string. For SPCR
revision 3 and above, `AsciiStrCpyS ()` writes `NAME_STR_SPCR_PORT` past
the end of `AcpiSpcr` and corrupts the adjacent global data of the
module. For revision 4 the installed table also includes those bytes,
read from beyond the template.

On a RISC-V platform the write overwrote the `SsdtCpuTopologyGenerator`
header in `DynamicTableFactoryDxe`: its `GeneratorID` became "COM1" and
the build of the SSDT CPU topology table, requested after the `SPCR`,
asserted on `AcpiTableInfo->TableGeneratorId == This->GeneratorID`.

Build the table in a buffer allocated with the full table size: copy
the template into it, store the namespace string for revision 4 and
free the buffer in `FreeSpcrTableEx ()` and on the error path.

Signed-off-by: Ilya Somkin <onto1024b@gmail.com>

0 files changed, 0 insertions, 0 deletions