1 files changed, 12 insertions, 2 deletions
diff --git a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
index 865b9ad1a4..e7b10149fb 100644
--- a/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
+++ b/MdeModulePkg/Universal/Variable/RuntimeDxe/VariableSmmRuntimeDxe.c
@@ -186,6 +186,7 @@ VariableLockRequestToLock (
   )
 {
   EFI_STATUS                                Status;
+  UINTN                                     VariableNameSize;
   UINTN                                     PayloadSize;
   SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE    *VariableToLock;
 
@@ -193,13 +194,22 @@ VariableLockRequestToLock (
     return EFI_INVALID_PARAMETER;
   }
 
+  VariableNameSize = StrSize (VariableName);
+
+  //
+  // If VariableName exceeds SMM payload limit. Return failure
+  //
+  if (VariableNameSize > mVariableBufferPayloadSize - OFFSET_OF (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE, Name)) {
+    return EFI_INVALID_PARAMETER;
+  }
+
   AcquireLockOnlyAtBootTime(&mVariableServicesLock);
 
   //
   // Init the communicate buffer. The buffer data size is:
   // SMM_COMMUNICATE_HEADER_SIZE + SMM_VARIABLE_COMMUNICATE_HEADER_SIZE + PayloadSize.
   //
-  PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE, Name) + StrSize (VariableName);
+  PayloadSize = OFFSET_OF (SMM_VARIABLE_COMMUNICATE_LOCK_VARIABLE, Name) + VariableNameSize;
   Status = InitCommunicateBuffer ((VOID **) &VariableToLock, PayloadSize, SMM_VARIABLE_FUNCTION_LOCK_VARIABLE);
   if (EFI_ERROR (Status)) {
     goto Done;
@@ -207,7 +217,7 @@ VariableLockRequestToLock (
   ASSERT (VariableToLock != NULL);
 
   CopyGuid (&VariableToLock->Guid, VendorGuid);
-  VariableToLock->NameSize = StrSize (VariableName);
+  VariableToLock->NameSize = VariableNameSize;
   CopyMem (VariableToLock->Name, VariableName, VariableToLock->NameSize);
 
   //