diff options
| author | oliviermartin <oliviermartin@6f19259b-4bc3-4df7-8a09-765794883524> | 2011-12-12 19:00:59 +0000 |
|---|---|---|
| committer | oliviermartin <oliviermartin@6f19259b-4bc3-4df7-8a09-765794883524> | 2011-12-12 19:00:59 +0000 |
| commit | d65502601ef44e28f2a6a9bb4d8d58aaa921c381 (patch) | |
| tree | 91302cb51a59b15a18e73e9f9a0bd0523e3818d7 /MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c | |
| parent | 7f070be5c98b39842f5d692d28406216f7e726fb (diff) | |
| download | edk2-platforms-d65502601ef44e28f2a6a9bb4d8d58aaa921c381.tar.xz | |
MdeModulePkg/Variable: Check if there is a NV Variable Storage header prior to use its attributes
The Variable PEI and RuntimeDxe drivers were using the attribute 'HeaderLength' of
EFI_FIRMWARE_VOLUME_HEADER without checking if a Firmware Volume Header was existing at
the base address.
In case the Firmware Volume Header does not exist or is corrupted, the attribute 'HeaderLength'
is a non valid value that can lead to a non valid physical address when accessing produces an
access error.
Signed-off-by: oliviermartin
Reviewed-by: niruiyu
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@12836 6f19259b-4bc3-4df7-8a09-765794883524
Diffstat (limited to 'MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c')
| -rw-r--r-- | MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c index 14d5d9c128..5aa6e3273d 100644 --- a/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c +++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/Variable.c @@ -1153,7 +1153,7 @@ VariableGetBestLanguage ( **/
VOID
-AutoUpdateLangVariable(
+AutoUpdateLangVariable (
IN CHAR16 *VariableName,
IN VOID *Data,
IN UINTN DataSize
@@ -2463,6 +2463,17 @@ VariableCommonInitialize ( if (TempVariableStoreHeader == 0) {
TempVariableStoreHeader = (EFI_PHYSICAL_ADDRESS) PcdGet32 (PcdFlashNvStorageVariableBase);
}
+
+ //
+ // Check if the Firmware Volume is not corrupted
+ //
+ if ((((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)(TempVariableStoreHeader))->Signature != EFI_FVH_SIGNATURE) ||
+ (!CompareGuid (&gEfiSystemNvDataFvGuid, &((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)(TempVariableStoreHeader))->FileSystemGuid))) {
+ Status = EFI_VOLUME_CORRUPTED;
+ DEBUG ((EFI_D_ERROR, "Firmware Volume for Variable Store is corrupted\n"));
+ goto Done;
+ }
+
VariableStoreBase = TempVariableStoreHeader + \
(((EFI_FIRMWARE_VOLUME_HEADER *)(UINTN)(TempVariableStoreHeader)) -> HeaderLength);
VariableStoreLength = (UINT64) PcdGet32 (PcdFlashNvStorageVariableSize) - \
|