sravan/system76-edk2
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

ShellPkg: BcfgDisplayDump(): enforce minimum size for Boot#### and co.

Browse Source 
"3.1.1 Boot Manager Programming" in the UEFI 2.5 spec mandates that
Boot#### and similar options contain EFI_LOAD_OPTION structures. The
EFI_LOAD_OPTION structure encodes the fixed initial part of the payload,
and we can (and should) use it to enforce a minimum size for variable
contents.

This patch is meant as a safety improvement.

Cc: Jaben Carsey <jaben.carsey@intel.com>
Cc: Ryan Harkin <ryan.harkin@linaro.org>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>

git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19710 6f19259b-4bc3-4df7-8a09-765794883524
This commit is contained in:
Laszlo Ersek
2016-01-21 18:40:09 +00:00
committed by lersek
parent 8f2c09f8b2
commit e5945ef784
2 changed files with 20 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

19
ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c
View File

@@ -1052,6 +1052,7 @@ BcfgDisplayDump(
CHAR16 *DevPathString; CHAR16 *DevPathString;
VOID *DevPath; VOID *DevPath;
UINTN Errors; UINTN Errors;
EFI_LOAD_OPTION *LoadOption;
if (OrderCount == 0) { if (OrderCount == 0) {
ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN(STR_BCFG_NONE), gShellBcfgHiiHandle, L"bcfg"); ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN(STR_BCFG_NONE), gShellBcfgHiiHandle, L"bcfg");
@@ -1090,6 +1091,24 @@ BcfgDisplayDump(
goto Cleanup; goto Cleanup;
} }
//
// We expect the Attributes, FilePathListLength, and L'\0'-terminated
// Description fields to be present.
//
if (BufferSize < sizeof *LoadOption + sizeof (CHAR16)) {
ShellPrintHiiEx (
-1,
-1,
NULL,
STRING_TOKEN (STR_BCFG_VAR_CORRUPT),
gShellBcfgHiiHandle,
L"bcfg",
VariableName
);
++Errors;
goto Cleanup;
}
if ((*(UINT16*)(Buffer+4)) != 0) { if ((*(UINT16*)(Buffer+4)) != 0) {
DevPath = AllocateZeroPool(*(UINT16*)(Buffer+4)); DevPath = AllocateZeroPool(*(UINT16*)(Buffer+4));
if (DevPath != NULL) { if (DevPath != NULL) {

1
ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.uni
View File

@@ -37,6 +37,7 @@
#string STR_GEN_OUT_MEM #language en-US "%H%s%N: Memory allocation was not successful.\r\n" #string STR_GEN_OUT_MEM #language en-US "%H%s%N: Memory allocation was not successful.\r\n"
#string STR_BCFG_WRITE_FAIL #language en-US "%H%s%N: Unable to write to '%H%s%N'\r\n" #string STR_BCFG_WRITE_FAIL #language en-US "%H%s%N: Unable to write to '%H%s%N'\r\n"
#string STR_BCFG_READ_FAIL #language en-US "%H%s%N: Unable to read from '%H%s%N'\r\n" #string STR_BCFG_READ_FAIL #language en-US "%H%s%N: Unable to read from '%H%s%N'\r\n"
#string STR_BCFG_VAR_CORRUPT #language en-US "%H%s%N: Variable '%H%s%N' corrupt.\r\n"
#string STR_BCFG_HANDLE #language en-US "%H%s%N: The handle [%H%02x%N] does not have DevicePath.\r\n" #string STR_BCFG_HANDLE #language en-US "%H%s%N: The handle [%H%02x%N] does not have DevicePath.\r\n"
#string STR_BCFG_FILE #language en-US "%H%s%N: The file '%H%s%N' matches multiple files.\r\n" #string STR_BCFG_FILE #language en-US "%H%s%N: The file '%H%s%N' matches multiple files.\r\n"
#string STR_BCFG_FILE_OPEN #language en-US "%H%s%N: The file '%H%s%N' did not open.\r\n" #string STR_BCFG_FILE_OPEN #language en-US "%H%s%N: The file '%H%s%N' did not open.\r\n"