MdeModulePkg/Bus/Ufs: Ensure device not return more data than expected
This commit adds checks to make sure the UFS devices do not return more data than the driver expected. Cc: Ruiyu Ni <ruiyu.ni@intel.com> Cc: Jiewen Yao <jiewen.yao@intel.com> Cc: Star Zeng <star.zeng@intel.com> Contributed-under: TianoCore Contribution Agreement 1.1 Signed-off-by: Hao Wu <hao.a.wu@intel.com> Reviewed-by: Star Zeng <star.zeng@intel.com>
This commit is contained in:
@@ -857,6 +857,14 @@ UfsRwDeviceDesc (
|
||||
SwapLittleEndianToBigEndian ((UINT8*)&ReturnDataSize, sizeof (UINT16));
|
||||
|
||||
if (Read) {
|
||||
//
|
||||
// Make sure the hardware device does not return more data than expected.
|
||||
//
|
||||
if (ReturnDataSize > Packet.InTransferLength) {
|
||||
Status = EFI_DEVICE_ERROR;
|
||||
goto Exit;
|
||||
}
|
||||
|
||||
CopyMem (Packet.InDataBuffer, (QueryResp + 1), ReturnDataSize);
|
||||
Packet.InTransferLength = ReturnDataSize;
|
||||
} else {
|
||||
@@ -1170,8 +1178,15 @@ UfsExecScsiCmds (
|
||||
SwapLittleEndianToBigEndian ((UINT8*)&SenseDataLen, sizeof (UINT16));
|
||||
|
||||
if ((Packet->SenseDataLength != 0) && (Packet->SenseData != NULL)) {
|
||||
CopyMem (Packet->SenseData, Response->SenseData, SenseDataLen);
|
||||
Packet->SenseDataLength = (UINT8)SenseDataLen;
|
||||
//
|
||||
// Make sure the hardware device does not return more data than expected.
|
||||
//
|
||||
if (SenseDataLen <= Packet->SenseDataLength) {
|
||||
CopyMem (Packet->SenseData, Response->SenseData, SenseDataLen);
|
||||
Packet->SenseDataLength = (UINT8)SenseDataLen;
|
||||
} else {
|
||||
Packet->SenseDataLength = 0;
|
||||
}
|
||||
}
|
||||
|
||||
//
|
||||
|
Reference in New Issue
Block a user