Fix potential overflow for SetVariable interface
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com> Reviewed-by : Guo Dong <dong.guo@intel.com> Reviewed-by : Siyuan Fu <siyuan.fu@intel.com> git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@14305 6f19259b-4bc3-4df7-8a09-765794883524
This commit is contained in:
@ -3,7 +3,7 @@
|
||||
Emulation Variable services operate on the runtime volatile memory.
|
||||
The nonvolatile variable space doesn't exist.
|
||||
|
||||
Copyright (c) 2006 - 2011, Intel Corporation. All rights reserved.<BR>
|
||||
Copyright (c) 2006 - 2013, Intel Corporation. All rights reserved.<BR>
|
||||
This program and the accompanying materials
|
||||
are licensed and made available under the terms and conditions of the BSD License
|
||||
which accompanies this distribution. The full text of the license may be found at
|
||||
@ -1397,14 +1397,22 @@ EmuSetVariable (
|
||||
if ((Attributes & (EFI_VARIABLE_RUNTIME_ACCESS | EFI_VARIABLE_BOOTSERVICE_ACCESS)) == EFI_VARIABLE_RUNTIME_ACCESS) {
|
||||
return EFI_INVALID_PARAMETER;
|
||||
}
|
||||
|
||||
|
||||
if ((UINTN)(~0) - DataSize < StrSize(VariableName)){
|
||||
//
|
||||
// Prevent whole variable size overflow
|
||||
//
|
||||
return EFI_INVALID_PARAMETER;
|
||||
}
|
||||
|
||||
//
|
||||
// The size of the VariableName, including the Unicode Null in bytes plus
|
||||
// the DataSize is limited to maximum size of PcdGet32 (PcdMaxHardwareErrorVariableSize)
|
||||
// bytes for HwErrRec, and PcdGet32 (PcdMaxVariableSize) bytes for the others.
|
||||
//
|
||||
if ((Attributes & EFI_VARIABLE_HARDWARE_ERROR_RECORD) == EFI_VARIABLE_HARDWARE_ERROR_RECORD) {
|
||||
if ((DataSize > PcdGet32 (PcdMaxHardwareErrorVariableSize)) ||
|
||||
(sizeof (VARIABLE_HEADER) + StrSize (VariableName) + DataSize > PcdGet32 (PcdMaxHardwareErrorVariableSize))) {
|
||||
if (StrSize (VariableName) + DataSize > PcdGet32 (PcdMaxHardwareErrorVariableSize) - sizeof (VARIABLE_HEADER)) {
|
||||
return EFI_INVALID_PARAMETER;
|
||||
}
|
||||
//
|
||||
@ -1418,8 +1426,7 @@ EmuSetVariable (
|
||||
// The size of the VariableName, including the Unicode Null in bytes plus
|
||||
// the DataSize is limited to maximum size of PcdGet32 (PcdMaxVariableSize) bytes.
|
||||
//
|
||||
if ((DataSize > PcdGet32 (PcdMaxVariableSize)) ||
|
||||
(sizeof (VARIABLE_HEADER) + StrSize (VariableName) + DataSize > PcdGet32 (PcdMaxVariableSize))) {
|
||||
if (StrSize (VariableName) + DataSize > PcdGet32 (PcdMaxVariableSize) - sizeof (VARIABLE_HEADER)) {
|
||||
return EFI_INVALID_PARAMETER;
|
||||
}
|
||||
}
|
||||
|
Reference in New Issue
Block a user