Fix potential integer underflow in variable-length table calculations

A table with an invalid `length` field can in theory cause out-of-bounds
accesses upon iteration of the table's entries. This will apply to all
variable-sized tables, so should be kept in mind for future additions.

Author: IsaacWoods

src/sdt/madt.rs

@@ -56,7 +56,7 @@ impl Madt {
         let ptr = unsafe { Pin::into_inner_unchecked(self) as *const Madt as *const u8 };
         MadtEntryIter {
             pointer: unsafe { ptr.add(mem::size_of::<Madt>()) },
-            remaining_length: self.header.length - mem::size_of::<Madt>() as u32,
+            remaining_length: self.header.length.saturating_sub(mem::size_of::<Madt>() as u32),
             _phantom: PhantomData,
         }
     }

src/sdt/mcfg.rs

@@ -24,7 +24,7 @@ impl Mcfg {
     /// Returns a slice containing each of the entries in the MCFG table. Where possible, `PlatformInfo.interrupt_model` should
     /// be enumerated instead.
     pub fn entries(&self) -> &[McfgEntry] {
-        let length = self.header.length as usize - mem::size_of::<Mcfg>();
+        let length = (self.header.length as usize).saturating_sub(mem::size_of::<Mcfg>());
 
         // Intentionally round down in case length isn't an exact multiple of McfgEntry size - this
         // has been observed on real hardware (see rust-osdev/acpi#58)

src/sdt/srat.rs

@@ -35,7 +35,7 @@ impl Srat {
         let ptr = unsafe { Pin::into_inner_unchecked(self) as *const Srat as *const u8 };
         SratEntryIter {
             pointer: unsafe { ptr.add(mem::size_of::<Srat>()) },
-            remaining_length: self.header.length - mem::size_of::<Srat>() as u32,
+            remaining_length: self.header.length.saturating_sub(mem::size_of::<Srat>() as u32),
             _phantom: PhantomData,
         }
     }