sravan/system76-edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix the TOCTOU issue of CommBufferSize itself for SMM communicate handler input.

Browse Source 
Signed-off-by: Star Zeng <star.zeng@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>

git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@14379 6f19259b-4bc3-4df7-8a09-765794883524
This commit is contained in:
lzeng14
2013-05-21 02:22:02 +00:00
parent 6ab9f44138
commit 164a9b6752
6 changed files with 53 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
MdeModulePkg/Universal/Acpi/FirmwarePerformanceDataTableSmm/FirmwarePerformanceSmm.c
View File

@@ -268,6 +268,7 @@ FpdtSmiHandler (
SMM_BOOT_RECORD_COMMUNICATE *SmmCommData;
UINTN BootRecordSize;
VOID *BootRecordData;
UINTN TempCommBufferSize;
//
// If input is invalid, stop processing this SMI
@@ -276,11 +277,13 @@ FpdtSmiHandler (
return EFI_SUCCESS;
}
if(*CommBufferSize < sizeof (SMM_BOOT_RECORD_COMMUNICATE)) {
TempCommBufferSize = *CommBufferSize;
if(TempCommBufferSize < sizeof (SMM_BOOT_RECORD_COMMUNICATE)) {
return EFI_SUCCESS;
}
if (!InternalIsAddressValid ((UINTN)CommBuffer, *CommBufferSize)) {
if (!InternalIsAddressValid ((UINTN)CommBuffer, TempCommBufferSize)) {
DEBUG ((EFI_D_ERROR, "FpdtSmiHandler: SMM communication data buffer in SMRAM or overflow!\n"));
return EFI_SUCCESS;
}