diff options
| author | Laszlo Ersek <lersek@redhat.com> | 2016-01-21 18:40:09 +0000 |
|---|---|---|
| committer | lersek <lersek@Edk2> | 2016-01-21 18:40:09 +0000 |
| commit | e5945ef78463a2a90631c91e9f8cff109fd20625 (patch) | |
| tree | af2910ae5677a8c26fcc11b84f377d76739c5ea6 /ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c | |
| parent | 8f2c09f8b2a8708db49e42bcac4cdfbccfa817d8 (diff) | |
| download | edk2-e5945ef78463a2a90631c91e9f8cff109fd20625.tar.gz edk2-e5945ef78463a2a90631c91e9f8cff109fd20625.tar.bz2 edk2-e5945ef78463a2a90631c91e9f8cff109fd20625.zip | |
ShellPkg: BcfgDisplayDump(): enforce minimum size for Boot#### and co.
"3.1.1 Boot Manager Programming" in the UEFI 2.5 spec mandates that
Boot#### and similar options contain EFI_LOAD_OPTION structures. The
EFI_LOAD_OPTION structure encodes the fixed initial part of the payload,
and we can (and should) use it to enforce a minimum size for variable
contents.
This patch is meant as a safety improvement.
Cc: Jaben Carsey <jaben.carsey@intel.com>
Cc: Ryan Harkin <ryan.harkin@linaro.org>
Contributed-under: TianoCore Contribution Agreement 1.0
Signed-off-by: Laszlo Ersek <lersek@redhat.com>
Reviewed-by: Jaben Carsey <jaben.carsey@intel.com>
git-svn-id: https://svn.code.sf.net/p/edk2/code/trunk/edk2@19710 6f19259b-4bc3-4df7-8a09-765794883524
Diffstat (limited to 'ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c')
| -rw-r--r-- | ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c | 19 |
1 files changed, 19 insertions, 0 deletions
diff --git a/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c b/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c index 36d04d495c..9955c9e640 100644 --- a/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c +++ b/ShellPkg/Library/UefiShellBcfgCommandLib/UefiShellBcfgCommandLib.c @@ -1052,6 +1052,7 @@ BcfgDisplayDump( CHAR16 *DevPathString;
VOID *DevPath;
UINTN Errors;
+ EFI_LOAD_OPTION *LoadOption;
if (OrderCount == 0) {
ShellPrintHiiEx(-1, -1, NULL, STRING_TOKEN(STR_BCFG_NONE), gShellBcfgHiiHandle, L"bcfg");
@@ -1090,6 +1091,24 @@ BcfgDisplayDump( goto Cleanup;
}
+ //
+ // We expect the Attributes, FilePathListLength, and L'\0'-terminated
+ // Description fields to be present.
+ //
+ if (BufferSize < sizeof *LoadOption + sizeof (CHAR16)) {
+ ShellPrintHiiEx (
+ -1,
+ -1,
+ NULL,
+ STRING_TOKEN (STR_BCFG_VAR_CORRUPT),
+ gShellBcfgHiiHandle,
+ L"bcfg",
+ VariableName
+ );
+ ++Errors;
+ goto Cleanup;
+ }
+
if ((*(UINT16*)(Buffer+4)) != 0) {
DevPath = AllocateZeroPool(*(UINT16*)(Buffer+4));
if (DevPath != NULL) {
|