MdeModulePkg/UdfDxe: Avoid possible loss track of allocated buffer

In function FindFileEntry():

Instead of using the function parameter 'FileEntry', use a local
variable to store the buffer allocated for disk read operation.

For the below calling stack:
UdfOpenVolume() -> FindRootDirectory() -> FindFileEntry()

In FindFileEntry(), the call to 'DiskIo->ReadDisk()' is possible (e.g.
media change for a CD/DVD ROM device) to trigger a re-install of the
BlockIO(2) protocol which will further lead to a call of the BindingStop()
& BingdingStart() of the UdfDxe driver.

Meanwhile, for the above listed calling stack, the '**FileEntry'
parameter passed into FindFileEntry() is '&PrivFsData->Root'. 'PrivFsData'
is a driver-managed private data, it will be freed in BindingStop() and
re-allocate in BingdingStart().

In such case, if '*FileEntry' is used to store the allocated buffer, the
information will be lost if 'DiskIo->ReadDisk()' triggers a re-install of
the BlockIO(2) protocol. The subsequent call of the FreePool API:

FreePool (*FileEntry);

will cause issues.

This commit uses a local variable to store the allocated buffer.

Cc: Ruiyu Ni <ruiyu.ni@intel.com>
Cc: Star Zeng <star.zeng@intel.com>
Cc: Eric Dong <eric.dong@intel.com>
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Hao Wu <hao.a.wu@intel.com>
Reviewed-by: Paulo Alcantara <pcacjr@zytor.com>

1 files changed, 7 insertions, 5 deletions

diff --git a/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c b/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c
index e048d95d31..ecc172303e 100644
--- a/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c
+++ b/MdeModulePkg/Universal/Disk/UdfDxe/FileSystemOperations.c
@@ -1615,12 +1615,13 @@ FindFileEntry (
   UINT64              Lsn;

   UINT32              LogicalBlockSize;

   UDF_DESCRIPTOR_TAG  *DescriptorTag;

+  VOID                *ReadBuffer;

 

   Lsn               = GetLongAdLsn (Volume, Icb);

   LogicalBlockSize  = Volume->LogicalVolDesc.LogicalBlockSize;

 

-  *FileEntry = AllocateZeroPool (Volume->FileEntrySize);

-  if (*FileEntry == NULL) {

+  ReadBuffer = AllocateZeroPool (Volume->FileEntrySize);

+  if (ReadBuffer == NULL) {

     return EFI_OUT_OF_RESOURCES;

   }

 

@@ -1632,13 +1633,13 @@ FindFileEntry (
     BlockIo->Media->MediaId,

     MultU64x32 (Lsn, LogicalBlockSize),

     Volume->FileEntrySize,

-    *FileEntry

+    ReadBuffer

     );

   if (EFI_ERROR (Status)) {

     goto Error_Read_Disk_Blk;

   }

 

-  DescriptorTag = *FileEntry;

+  DescriptorTag = ReadBuffer;

 

   //

   // Check if the read extent contains a valid Tag Identifier for the expected

@@ -1650,11 +1651,12 @@ FindFileEntry (
     goto Error_Invalid_Fe;

   }

 

+  *FileEntry = ReadBuffer;

   return EFI_SUCCESS;

 

 Error_Invalid_Fe:

 Error_Read_Disk_Blk:

-  FreePool (*FileEntry);

+  FreePool (ReadBuffer);

 

   return Status;

 }