Add comment for modules which have external input.

signed-off-by: jiewen.yao@intel.com
reviewed-by: guo.dong@intel.com
reviewed-by: ting.ye@intel.com
reviewed-by: liming.gao@intel.com
reviewed-by: elvin.li@intel.com



git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@13446 6f19259b-4bc3-4df7-8a09-765794883524

1 files changed, 17 insertions, 0 deletions

diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h
index bfb2f4e8f7..14a0744a57 100644
--- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h
+++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/Variable.h
@@ -402,6 +402,10 @@ GetFvbInfoByAddress (
 

   This code finds variable in storage blocks (Volatile or Non-Volatile).

 

+  Caution: This function may receive untrusted input.

+  This function may be invoked in SMM mode, and datasize and data are external input.

+  This function will do basic validation, before parse the data.

+

   @param VariableName               Name of Variable to be found.

   @param VendorGuid                 Variable vendor GUID.

   @param Attributes                 Attribute value of the variable found.

@@ -429,6 +433,9 @@ VariableServiceGetVariable (
 

   This code Finds the Next available variable.

 

+  Caution: This function may receive untrusted input.

+  This function may be invoked in SMM mode. This function will do basic validation, before parse the data.

+

   @param VariableNameSize           Size of the variable name.

   @param VariableName               Pointer to variable name.

   @param VendorGuid                 Variable Vendor Guid.

@@ -451,6 +458,13 @@ VariableServiceGetNextVariableName (
 

   This code sets variable in storage blocks (Volatile or Non-Volatile).

 

+  Caution: This function may receive untrusted input.

+  This function may be invoked in SMM mode, and datasize and data are external input.

+  This function will do basic validation, before parse the data.

+  This function will parse the authentication carefully to avoid security issues, like

+  buffer overflow, integer overflow.

+  This function will check attribute carefully to avoid authentication bypass.

+

   @param VariableName                     Name of Variable to be found.

   @param VendorGuid                       Variable vendor GUID.

   @param Attributes                       Attribute value of the variable found

@@ -479,6 +493,9 @@ VariableServiceSetVariable (
 

   This code returns information about the EFI variables.

 

+  Caution: This function may receive untrusted input.

+  This function may be invoked in SMM mode. This function will do basic validation, before parse the data.

+

   @param Attributes                     Attributes bitmask to specify the type of variables

                                         on which to return information.

   @param MaximumVariableStorageSize     Pointer to the maximum size of the storage space available