From d3a7acfff9d73ebb41e59d550f236a07d2c8c631 Mon Sep 17 00:00:00 2001
From: Pierre Gondois <pierre.gondois@arm.com>
Date: Wed, 8 Jul 2026 17:09:05 +0200
Subject: [PATCH] DynamicTablesPkg: Check Rd Address Space field combination

Some combination of fields of Rd Address Space descriptors
are not valid. Check them when updating a Rd Address Space
descriptor.

Cf. ACPI 6.4 Table 6.44:
"Valid Combination of Address Space Descriptor Fields"

Also check that the input length is not 0 to avoid
potential integer underflow.

Signed-off-by: Pierre Gondois <pierre.gondois@arm.com>
---
 .../Common/AmlLib/Api/AmlResourceDataApi.c    | 23 ++++++++++++++++++-
 1 file changed, 22 insertions(+), 1 deletion(-)

diff --git a/DynamicTablesPkg/Library/Common/AmlLib/Api/AmlResourceDataApi.c b/DynamicTablesPkg/Library/Common/AmlLib/Api/AmlResourceDataApi.c
index d261adb6b8..9801ef6163 100644
--- a/DynamicTablesPkg/Library/Common/AmlLib/Api/AmlResourceDataApi.c
+++ b/DynamicTablesPkg/Library/Common/AmlLib/Api/AmlResourceDataApi.c
@@ -20,6 +20,12 @@
 #include <AmlInclude.h>
 #include <Api/AmlApiHelper.h>
 #include <CodeGen/AmlResourceDataCodeGen.h>
+#include <Utils/AmlUtility.h>
+
+/* Macros to read General flags of a Resource Data Address Descriptors */
+#define IS_RD_ADDR_POS_DECODE(GenFlag)  (((GenFlag) & BIT1) == 0)
+#define IS_RD_ADDR_MIN_FIXED(GenFlag)   (((GenFlag) & BIT2) == BIT2)
+#define IS_RD_ADDR_MAX_FIXED(GenFlag)   (((GenFlag) & BIT3) == BIT3)
 
 /** Update the first interrupt of an Interrupt resource data node.
 
@@ -271,7 +277,8 @@ AmlUpdateRdQWord (
           AML_RD_BUILD_LARGE_DESC_ID (
             ACPI_LARGE_QWORD_ADDRESS_SPACE_DESCRIPTOR_NAME
             )
-          )))
+          )) ||
+      (BaseAddressLength == 0))
   {
     ASSERT (0);
     return EFI_INVALID_PARAMETER;
@@ -313,6 +320,20 @@ AmlUpdateRdQWord (
   RdQWord->AddrRangeMax = BaseAddress + BaseAddressLength - 1;
   RdQWord->AddrLen      = BaseAddressLength;
 
+  Status = CheckAddressSpaceFields (
+             IS_RD_ADDR_MIN_FIXED (RdQWord->GenFlag),
+             IS_RD_ADDR_MAX_FIXED (RdQWord->GenFlag),
+             RdQWord->AddrSpaceGranularity,
+             RdQWord->AddrRangeMin,
+             RdQWord->AddrRangeMax,
+             RdQWord->AddrTranslationOffset,
+             RdQWord->AddrLen
+             );
+  if (EFI_ERROR (Status)) {
+    ASSERT (0);
+    goto error_handler;
+  }
+
   // Update Base Address Resource Data node.
   Status = AmlUpdateDataNode (
              QWordRdNode,