diff options
| author | czhang46 <czhang46@6f19259b-4bc3-4df7-8a09-765794883524> | 2013-04-22 08:52:58 +0000 |
|---|---|---|
| committer | czhang46 <czhang46@6f19259b-4bc3-4df7-8a09-765794883524> | 2013-04-22 08:52:58 +0000 |
| commit | 56251c669f0f13d2ffc226cfd3a3d8c5f8269e7a (patch) | |
| tree | 22364392e9453e22804f1a573a4011daf4a0ec95 /SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c | |
| parent | b6d1508f17777c96287a01db36bcde2d41a27323 (diff) | |
| download | edk2-platforms-56251c669f0f13d2ffc226cfd3a3d8c5f8269e7a.tar.xz | |
Fix potential overflow for SetVariable interface
Signed-off-by: Chao Zhang <chao.b.zhang@intel.com>
Reviewed-by : Guo Dong <dong.guo@intel.com>
Reviewed-by : Siyuan Fu <siyuan.fu@intel.com>
git-svn-id: https://edk2.svn.sourceforge.net/svnroot/edk2/trunk/edk2@14305 6f19259b-4bc3-4df7-8a09-765794883524
Diffstat (limited to 'SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c')
| -rw-r--r-- | SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c index 9f750d6780..5a02b77d53 100644 --- a/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c +++ b/SecurityPkg/VariableAuthenticated/RuntimeDxe/VariableSmmRuntimeDxe.c @@ -442,8 +442,15 @@ RuntimeServiceSetVariable ( return EFI_INVALID_PARAMETER;
}
+ if ((UINTN)(~0) - StrSize (VariableName) < OFFSET_OF (SMM_VARIABLE_COMMUNICATE_ACCESS_VARIABLE, Name) + DataSize) {
+ //
+ // Prevent PayloadSize overflow
+ //
+ return EFI_INVALID_PARAMETER;
+ }
+
AcquireLockOnlyAtBootTime(&mVariableServicesLock);
-
+
//
// Init the communicate buffer. The buffer data size is:
// SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.
|