diff options
| author | Ruiyu Ni <ruiyu.ni@intel.com> | 2018-03-16 15:04:05 +0800 |
|---|---|---|
| committer | Ruiyu Ni <ruiyu.ni@intel.com> | 2018-03-16 17:37:27 +0800 |
| commit | 61384921e01a16dc33efec3f25f32d08a78cd30b (patch) | |
| tree | 01aafad8d6625fcd7a82ddeefa4db13b0fce9a88 /MdeModulePkg | |
| parent | a508ac4b01fbbc614ba9bf715c4208672434f854 (diff) | |
| download | edk2-61384921e01a16dc33efec3f25f32d08a78cd30b.tar.gz edk2-61384921e01a16dc33efec3f25f32d08a78cd30b.tar.bz2 edk2-61384921e01a16dc33efec3f25f32d08a78cd30b.zip | |
MdeModulePkg/DxeCapsuleLibFmp: Add more check for the UX capsule
Contributed-under: TianoCore Contribution Agreement 1.1
Signed-off-by: Ruiyu Ni <ruiyu.ni@intel.com>
Reviewed-by: Jiewen Yao <jiewen.yao@intel.com>
(cherry picked from commit d0976b9accedfd1f45fe2f81c59351ed17f34aa0)
Diffstat (limited to 'MdeModulePkg')
| -rw-r--r-- | MdeModulePkg/Library/DxeCapsuleLibFmp/DxeCapsuleLib.c | 21 |
1 files changed, 19 insertions, 2 deletions
diff --git a/MdeModulePkg/Library/DxeCapsuleLibFmp/DxeCapsuleLib.c b/MdeModulePkg/Library/DxeCapsuleLibFmp/DxeCapsuleLib.c index 8f4e6b8951..13fe388719 100644 --- a/MdeModulePkg/Library/DxeCapsuleLibFmp/DxeCapsuleLib.c +++ b/MdeModulePkg/Library/DxeCapsuleLibFmp/DxeCapsuleLib.c @@ -586,8 +586,25 @@ DisplayCapsuleImage ( UINTN Width;
EFI_GRAPHICS_OUTPUT_PROTOCOL *GraphicsOutput;
- ImagePayload = (DISPLAY_DISPLAY_PAYLOAD *)(CapsuleHeader + 1);
- PayloadSize = CapsuleHeader->CapsuleImageSize - sizeof(EFI_CAPSULE_HEADER);
+ //
+ // UX capsule doesn't have extended header entries.
+ //
+ if (CapsuleHeader->HeaderSize != sizeof (EFI_CAPSULE_HEADER)) {
+ return EFI_UNSUPPORTED;
+ }
+ ImagePayload = (DISPLAY_DISPLAY_PAYLOAD *)((UINTN) CapsuleHeader + CapsuleHeader->HeaderSize);
+ //
+ // (CapsuleImageSize > HeaderSize) is guaranteed by IsValidCapsuleHeader().
+ //
+ PayloadSize = CapsuleHeader->CapsuleImageSize - CapsuleHeader->HeaderSize;
+
+ //
+ // Make sure the image payload at least contain the DISPLAY_DISPLAY_PAYLOAD header.
+ // Further size check is performed by the logic translating BMP to GOP BLT.
+ //
+ if (PayloadSize <= sizeof (DISPLAY_DISPLAY_PAYLOAD)) {
+ return EFI_INVALID_PARAMETER;
+ }
if (ImagePayload->Version != 1) {
return EFI_UNSUPPORTED;
|