diff options
| author | Eric Dong <eric.dong@intel.com> | 2016-10-27 14:17:54 +0800 |
|---|---|---|
| committer | Star Zeng <star.zeng@intel.com> | 2016-11-09 17:49:17 +0800 |
| commit | c3c9892c3b4dafd1d0ccdc8e5e017d80e8c4361e (patch) | |
| tree | 772bf3abcd2a57a0420c839b7c61e68a051c643c | |
| parent | fb9405f9583a6ecf2048cdcc2e8d5621a3e68c75 (diff) | |
| download | edk2-c3c9892c3b4dafd1d0ccdc8e5e017d80e8c4361e.tar.gz edk2-c3c9892c3b4dafd1d0ccdc8e5e017d80e8c4361e.tar.bz2 edk2-c3c9892c3b4dafd1d0ccdc8e5e017d80e8c4361e.zip | |
MdePkg UefiDevicePathLib: Validate before touch input buffer.
Current code not validate the input buffer before touch.
it may touch the buffer outside the validate scope. This
patch validate the input size big enough to touch the
first node.
Cc: Ruiyu NI <ruiyu.ni@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Eric Dong <eric.dong@intel.com>
| -rw-r--r-- | MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c | 26 |
1 files changed, 21 insertions, 5 deletions
diff --git a/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c b/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c index 024dcc271d..bb4a56398e 100644 --- a/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c +++ b/MdePkg/Library/UefiDevicePathLib/DevicePathUtilities.c @@ -61,17 +61,33 @@ IsDevicePathValid ( ASSERT (DevicePath != NULL);
+ if (MaxSize == 0) {
+ MaxSize = MAX_UINTN;
+ }
+
+ //
+ // Validate the input size big enough to touch the first node.
+ //
+ if (MaxSize < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {
+ return FALSE;
+ }
+
for (Count = 0, Size = 0; !IsDevicePathEnd (DevicePath); DevicePath = NextDevicePathNode (DevicePath)) {
NodeLength = DevicePathNodeLength (DevicePath);
if (NodeLength < sizeof (EFI_DEVICE_PATH_PROTOCOL)) {
return FALSE;
}
- if (MaxSize > 0) {
- Size += NodeLength;
- if (Size + END_DEVICE_PATH_LENGTH > MaxSize) {
- return FALSE;
- }
+ if (NodeLength > MAX_UINTN - Size) {
+ return FALSE;
+ }
+ Size += NodeLength;
+
+ //
+ // Validate next node before touch it.
+ //
+ if (Size > MaxSize - END_DEVICE_PATH_LENGTH ) {
+ return FALSE;
}
if (PcdGet32 (PcdMaximumDevicePathNodeCount) > 0) {
|